Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 18 Feb 2016 23:19:10 +0000
From: Darren Martyn <>
Subject: Re: Address Sanitizer local root

Hi List,
Figured I would add this to the thread to keep it amusing.

Here is a fully functioning local root by clobbering /etc/
instead of /etc/shadow (which breaks things spectacularly). I am using a
fairly messy "symlink spray"/"symlink carpet bombing" technique.

Simply point it at a setuid-root binary compiled with asan and away it

PoC Code:

Development/Testing was done on a Debian 8.3 VM that was last updated
last week.

Now, I wonder - what can actually be done to mitigate against this,
besides "don't use ASAN in production"?
Is there something that can be done ASAN-side?
Because due to how is parsed so, uh, forgivingly, all the
attacker needs to control is one line in the output file. Could it check
for symlinks before writing the log?


Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.