Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Nov 2015 09:27:03 +0100
From: Yves-Alexis Perez <>
Subject: Re: On techniques for preventing commit_creds()
 user-space abuse

On jeu., 2015-11-26 at 00:14 +0100, Salva Peiró wrote:
> Given the typical path for kernel exploitation is the
> `commit_creds(prepare_kernel_cred(0))` being called from user space as
> detailed in [References].
> Why is not a check placed in commit_creds() that checks the return address
> of the call to ensure the call is a legit one coming from kernel space?.

I have the feeling that commit_creds(prepare_creds(0)) is just a quick way for
white hats / good guys to demonstrate a vulnerability by showing an exploit
leading to privilege escalation (or rooting Android devices).

As already said elsewere, we don't have much data on the exploitation
techniques used by real bad guys, but I somehow assume that if you have ring 0
access, the first things you do is disable existing protections and insert
kernel code in order to have free hands on userspace.


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.