[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 15 Jun 2020 04:26:37 -0600
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: linux-security-module@...r.kernel.org, linux-acpi@...r.kernel.org,
Matthew Garrett <mjg59@...f.ucam.org>, kernel-hardening@...ts.openwall.com,
Ubuntu Kernel Team <kernel-team@...ts.ubuntu.com>
Subject: lockdown bypass on mainline kernel for loading unsigned modules
Hi everyone,
Yesterday, I found a lockdown bypass in Ubuntu 18.04's kernel using
ACPI table tricks via the efi ssdt variable [1]. Today I found another
one that's a bit easier to exploit and appears to be unpatched on
mainline, using acpi_configfs to inject an ACPI table. The tricks are
basically the same as the first one, but this one appears to be
unpatched, at least on my test machine. Explanation is in the header
of the PoC:
https://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language-2.sh
I need to get some sleep, but if nobody posts a patch in the
meanwhile, I'll try to post a fix tomorrow.
Jason
[1] https://www.openwall.com/lists/oss-security/2020/06/14/1
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
