Date: Thu, 26 Nov 2015 09:27:03 +0100 From: Yves-Alexis Perez <corsac@...ian.org> To: kernel-hardening@...ts.openwall.com Subject: Re: On techniques for preventing commit_creds() user-space abuse On jeu., 2015-11-26 at 00:14 +0100, Salva Peiró wrote: > Given the typical path for kernel exploitation is the > `commit_creds(prepare_kernel_cred(0))` being called from user space as > detailed in [References]. > Why is not a check placed in commit_creds() that checks the return address > of the call to ensure the call is a legit one coming from kernel space?. I have the feeling that commit_creds(prepare_creds(0)) is just a quick way for white hats / good guys to demonstrate a vulnerability by showing an exploit leading to privilege escalation (or rooting Android devices). As already said elsewere, we don't have much data on the exploitation techniques used by real bad guys, but I somehow assume that if you have ring 0 access, the first things you do is disable existing protections and insert kernel code in order to have free hands on userspace. Regards, -- Yves-Alexis Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.