[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Nov 2015 09:27:03 +0100
From: Yves-Alexis Perez <corsac@...ian.org>
To: kernel-hardening@...ts.openwall.com
Subject: Re: On techniques for preventing commit_creds()
user-space abuse
On jeu., 2015-11-26 at 00:14 +0100, Salva Peiró wrote:
> Given the typical path for kernel exploitation is the
> `commit_creds(prepare_kernel_cred(0))` being called from user space as
> detailed in [References].
> Why is not a check placed in commit_creds() that checks the return address
> of the call to ensure the call is a legit one coming from kernel space?.
I have the feeling that commit_creds(prepare_creds(0)) is just a quick way for
white hats / good guys to demonstrate a vulnerability by showing an exploit
leading to privilege escalation (or rooting Android devices).
As already said elsewere, we don't have much data on the exploitation
techniques used by real bad guys, but I somehow assume that if you have ring 0
access, the first things you do is disable existing protections and insert
kernel code in order to have free hands on userspace.
Regards,
--
Yves-Alexis
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
