[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 20 Jul 2020 18:33:03 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: lockdown bypass on mainline kernel for
loading unsigned modules
Hi,
CVE-2020-15780 was assigned to this.
Ciao, Marcus.
On Mon, Jun 15, 2020 at 05:03:12PM -0600, Jason A. Donenfeld wrote:
> Hi Mitre,
>
> People are requesting a CVE to track this and are poking me to poke
> you to assign one. Note that this would be for a *different* CVE than
> the one I requested for the Ubuntu vulnerability a minute ago. This
> vulnerability here affects a different set of kernels and uses a
> different vector.
>
> Jason
>
> On Mon, Jun 15, 2020 at 4:26 AM Jason A. Donenfeld <Jason@...c4.com> wrote:
> >
> > Hi everyone,
> >
> > Yesterday, I found a lockdown bypass in Ubuntu 18.04's kernel using
> > ACPI table tricks via the efi ssdt variable [1]. Today I found another
> > one that's a bit easier to exploit and appears to be unpatched on
> > mainline, using acpi_configfs to inject an ACPI table. The tricks are
> > basically the same as the first one, but this one appears to be
> > unpatched, at least on my test machine. Explanation is in the header
> > of the PoC:
> >
> > https://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language-2.sh
> >
> > I need to get some sleep, but if nobody posts a patch in the
> > meanwhile, I'll try to post a fix tomorrow.
> >
> > Jason
> >
> > [1] https://www.openwall.com/lists/oss-security/2020/06/14/1
>
--
Marcus Meissner,SUSE LINUX GmbH; Maxfeldstrasse 5; D-90409 Nuernberg; Zi. 3.1-33,+49-911-740 53-432,,serv=loki,mail=wotan,type=real <meissner@...e.de>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
