Date: Fri, 9 Apr 2021 13:06:09 +0300 From: Alexander Popov <alex.popov@...ux.com> To: oss-security <oss-security@...ts.openwall.com> Cc: linux-distros@...openwall.org, Linus Torvalds <torvalds@...uxfoundation.org>, Greg KH <greg@...ah.com>, "security@...nel.org" <security@...nel.org>, Norbert Slusarek <nslusarek@....net>, Stefano Garzarella <sgarzare@...hat.com>, Eric Dumazet <edumazet@...gle.com>, Anthony Liguori <aliguori@...zon.com>, David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Jorgen Hansen <jhansen@...are.com>, Stefan Schmidt <stefan@...enfreihafen.org>, Jeff Vander Stoep <jeffv@...gle.com>, Andrey Konovalov <andreyknvl@...gle.com> Subject: Re: Linux kernel: Exploitable vulnerabilities in AF_VSOCK implementation Hello! I published a detailed article about exploiting CVE-2021-26708 in AF_VSOCK implementation: https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html In this article I describe how to gain local privilege escalation on Fedora 33 Server for x86_64, bypassing SMEP and SMAP. The race condition may cause write-after-free of a 4-byte controlled value to a 64-byte kernel object at offset 40. That's quite limited memory corruption. I had a hard time turning it into arbitrary read/write of kernel memory. In this article I also describe possible exploit mitigations that could prevent exploitation of CVE-2021-26708 or at least make it harder. Best regards, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.