13 ms·
One exercise on pwn.college in their kernel security module is they have a program that forks, opens the flag file (/flag owned by root), reads the content, and
by commandersaki 4y ago
One exercise on pwn.college in their kernel security module is they have a program that forks, opens the flag file (/flag owned by root), reads the content, and then child process exits.
The program continues to run to allow you to load in shell code that'll be run by the kernel.
Your task is basically to write some shellcode to scan the memory for the flag. So now I know that at least some Linux-es don't clean up after a process exits, and you can get the contents of memory when you have kernel privileges. This is not so easy if you're scanning memory as root since /dev/mem or whatever won't reveal that process memory.
- zamnos 4y agohere, I made it clickable: http://pwn.college http://pwn.college
- gaudat 4y agoOh it is free too. Gotta try this.
- djbusby 4y agoThe memory wipe is a kernel build-time config option.
- CodesInChaos 4y agoDo you know what the option is called? edit: apparently the runtime option is called `init_on_alloc` and the compile-time option (which determines the default of the runtime option) is called `CONFIG_INIT_ON_FREE_DEFAULT_ON`.
- CodesInChaos 4y agoBy default memory is wiped before it's handed out again, not when it's freed. This improves performance, but means secrets can remain in RAM for longer than necessary, where they can be accessed by privileged attackers (software running as root, DMA without MMU, or hardware attacks). For unprivileged processes eager and lazy zeroing look the same.
- seri4l 4y agoApparently there's a kernel config flag to zero the memory on free (CONFIG_INIT_ON_FREE_DEFAULT_ON) but it has a quite expensive performance cost (3-5% according to the docs). I wonder in what kind of scenario it would make sense to enable it.
- bayindirh 4y agoAny multi-user system where users don't know each other and handle sensitive data.
- LinuxBender 4y agoDo you mean init_on_alloc=1 and init_on_free=1? Here [1] is a thread on the options and performance impact. FWIW I use it on all my workstations but these days I am not doing anything that would be greatly impacted by it. I've never tried it on a gaming machine and never tried it on a large memory hypervisor. I wish there were flags similar to this for the GPU memory. Even something that zero's GPU memory on reboot would be nice. I can always see the previous desktop after a reboot for a brief moment. [1] - https://patchwork.kernel.org/project/linux-mm/patch/20190617151050.92663-2-glider@google.com/ https://patchwork.kernel.org/project/linux-mm/patch/20190617...
- dathinab 4y ago> don't clean up after a process exits exactly, the only guarantee is that things are zeroed before handing them out to a different process, but there is some potential time gap between releasing memory back to the kernel and it being cleaned, a gap which can outlive the live of a process > and you can get the contents of memory when you have kernel privileges. This is not so easy [..] as root yes, root has much less privileges then the kernel, but often can gain kernel privileges. But this is where e.g. lockdown mode comes in which denies the root users such privilege escalation (oversimplified, it's complicated). Main problem is that lockdown mode is not yet compatible with suspend to disk (hibernation), even through its documentation implies it is, if your have a encrypted hibernation. (This is misleading as it refers to a not yet existing feature where the kernel creates a encrypted image which is also tamper proof even if root tries to tamper. On the other hand suspend to an encrypted partition is possible in Linux, but not enough for lockdown mode to work.)