[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <07D12CE0-60AE-4D40-B15F-1F4AB67F1534@gmail.com>
Date: Sun, 21 Jul 2019 23:19:56 +0400
From: Ilya Matveychikov <matvejchikov@...il.com>
To: lkrg-users@...ts.openwall.com
Subject: LKRG 0.7 CI & ED bypass
Hello,
Nice to see LKRG version 0.7 here, I wonder it is still alive.
This time I’d like to use a CHAIN!!11 of 2 by-design bugs in LKRG to
show how to bypass both CI and ED:
- (1) bypass of CI by locking a “text_mutex” which makes CI stuck on
acquiring it, so no CI will be performed
- (2) bypass of ED by patching kprobes dispatcher function (get_kprobes),
so LKRG-hooks will not be triggered by kprobes
Unfortunately, don’t have much time to do proper cleanup for this but as
usual I’ve published some code on github so anyone can play with:
https://github.com/milabs/kernel-exploits/commits/lkrg0.7-bypass
Also, I don’t know how good LKRG SMEP protection is as I don’t have a proper
device to make tests but as far as I can see SMEP protection (as well as WP once)
is also kprobes-based, so I’m guessing this approach will defeat it as well.
Did I miss something?
Ilya
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
