9 ms·
Linux local privilege escalation 0day, 2.6.37 - 3.8.10
- ezdiy 14y agoSilent patched a while ago: Kernel must be compiled with PERF_EVENTS (default on most modern distros). Bug fixed in 3.8.10. This is the kill log: http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/04302.html http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/04302.... This bug got apparently backported from 2.6.37 into centos6 2.6.32 kernels. patch here: https://patchwork.kernel.org/patch/2441281/ https://patchwork.kernel.org/patch/2441281/
- calinet6 14y agoThe patch looks like it's present in 3.8.9 also, correct? (someone double-check)
- ezdiy 14y agoYou're correct. Bug is in 2.6.37-3.8.8, fixed in 3.8.9. http://lxr.linux.no/linux+v3.8.9/kernel/events/core.c#L5331 http://lxr.linux.no/linux+v3.8.9/kernel/events/core.c#L5331
- ezdiy 14y agoSpender did excellent write-up about how it exactly works: http://www.reddit.com/r/netsec/comments/1eb9iw/sdfucksheeporgs_semtexc_local_linux_root_exploit/c9ykrck http://www.reddit.com/r/netsec/comments/1eb9iw/sdfucksheepor...
- reiche 14y agoHm, doubtful. PS1/ $ w 12:17:27 up 38 days, 17:18, 1 user, load average: 0.44, 0.11, 0.04 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT user pts/0 Narnia 07:11 0.00s 0.25s 0.11s w PS1/ $ uname -a Linux Rivendell 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux PS1/ $ cat /etc/redhat\-release CentOS release 6.4 (Final) PS1/ $ ./a.out 2.6.37-3.x x86_64 sd@fucksheep.org 2010 a.out: sheep.c:81: main: Assertion `p = memmem(code, 1024, &needle, 8)' failed. Abort(coredump) PS1/ Seems it is nicely dumped instead of doing weird things in userland. Under root is doesn't coredump, but returns to the prompt without any hassle.
- ezdiy 14y agoEither your kernel is patched, or the exploit does not work on your system. It certainly fails without -O2, glance over the code indicates horrible reliance on various UB on how gcc compiles it. $ grep -A 10 'int perf_swevent_init' linux-2.6.32-358.el6/kernel/events/core.c static int perf_swevent_init(struct perf_event *event) { int event_id = event->attr.config; if (event->attr.type != PERF_TYPE_SOFTWARE) return -ENOENT; switch (event_id) { case PERF_COUNT_SW_CPU_CLOCK: case PERF_COUNT_SW_TASK_CLOCK: return -ENOENT;
- deleted 14y ago[deleted]
- wwdevries 14y agoYou get this error when you compile the exploit incorrectly. Compile like this and it works: gcc -O2 sheep.c && ./a.out
- buster 14y agoCan we please stop posts like that without a proper introduction? I'm counting myself as proficient in Linux for many years and all i get is that it's some C code and apparently some 0day. What? I'm certainly not starting to decipher that or compile and run it. p.s.: same should go for all the "x anounces y" where the posted link neither explains what x is nor what y is.
- rdl 14y agoI wish HN would allow both text and links in the same article. Otherwise you basically have to write a blog entry.
- mooism2 14y agoHN encourages you to write a blog post and submit that, yes.
- dalore 14y agoI believe rdl wants HN to be their blog.
- rdl 14y agoHN hates "blogspam", so I'd be reluctant to write a 1-3 para intro and then cite a post like this, then submit it to HN. Although I guess if it added context, it wouldn't be horrible.
- mooism2 14y agoIf you haven't got enough to say that would raise a blog post above being blogspam, then submit your thoughts as a comment after submitting the link.
- astrodust 14y agoI'm sure that's nearly impossible to manage in this day and age. If only someone could create a service that made such a thing easy.
- 0x0 14y agoIs there a CVE for this one?
- pja 14y agoWorks on Debian stable (wheezy). Joy unconfined.
- yebyen 14y agoI have an ubuntu precise that has been keeping up with kernel updates, running 3.2.0-41-generic, and it does not give root. Whether the vulnerability is patched or the exploit just doesn't work, I can't say, but I get this: yebyen@oneiric64:~$ gcc -O2 semtex.c yebyen@oneiric64:~$ ./a.out Killed (Don't worry the hostname is oneiric64. It's not running oneiric.)
- ezdiy 14y agoTry dmesg.
- yebyen 14y agoI checked dmesg. It's clear that something bad happened, but I didn't get root. I don't really know what I'm looking at, I just ran arbitrary code on my least valuable machine trying to learn something. Want me to pastebin it? edit: It starts out [318258.327110] BUG: unable to handle kernel paging request at 0000001781ef7788 [318258.328251] IP: [<ffffffff8108f1a5>] atomic_dec_and_mutex_lock+0x15/0x90 [318258.328251] PGD 2b18b067 PUD 0 [318258.328251] Oops: 0000 [#4] SMP
- cmars 14y agoSame here: Linux (redacted) 3.2.0-41-virtual #66-Ubuntu SMP Thu Apr 25 03:47:17 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux [ 413.309308] BUG: unable to handle kernel paging request at 0000001781eef4e8 [ 413.310359] IP: [<ffffffff8108d605>] atomic_dec_and_mutex_lock+0x15/0xa0 [ 413.311025] PGD 1c4ec067 PUD 0 [ 413.311680] Oops: 0000 [#6] SMP [ 413.312007] CPU 0 Edit: disregard the timestamp above, VM has not synced with NTP for some time.
- yebyen 14y ago
- theon144 14y agoWait, so let me get this right: This is a Linux local privilege escalation 0day that works on (most) kernels ver. 2.6.37 to 3.8.10?
- calinet6 14y agoWell... [2.6.37, 3.8.10) -- non-inclusive on the upper bound. Fixed in 3.8.10 so that one's good. Otherwise, yes, yes it is. *Edit: Actually it looks like it's fixed in 3.8.9 (made it in 3.8.9rc8) based on the patch at: https://patchwork.kernel.org/patch/2441281/ https://patchwork.kernel.org/patch/2441281/ -- Someone with more knowledge of kernel dev should double-check.
- Anderkent 14y agoAnd the bug was apparently backported to 2.6.32 on CentOS.
- ddalex_ro 14y agoJust from looking at the code, this exploit works only for 32 bit machines, all 64 bit installations should be fine.
- 0x0 14y agoCan you back that up? The exploit states x86_64, and even if there is only an x86 exploit published, it's likely the same vulnerability is present on an x86_64 kernel (in general). Lack of exploit code doesn't imply a lack of vulnerability :)
- ddalex_ro 14y agoI mean, the fix consists in making sure that attr.config has all the 64 bits cleared - on the 64 bit machines, int is 64bit, so u64 == int, and all the bits are correctly handled. on 32 bit machines, int is 32bit, and the top 32 bit of attr.config is not cleared. I may be wrong though, as I didn't scan through all the affected code.
- ah- 14y agoI just tried it on a 64bit machine and it works.
- jbaiter 14y agoI just ran the exploit on a 64bit machine and it worked as expected, I got root privileges.
- sd_ 14y agoIt's not that hard to port it to 32 bits, just hang on week or two. I'm just too lazy. IGjDf1e4eQxWyBFArYM8HgvCuns6p+GbfHoE3SPxYV59kXnA12BWdMr6D5eAAFgtBSX+/Yi+vLxMmEiszkwHLCA=
- rommelvr 14y agoHahaha. Love that you signed your message with your 'jewgold' address. Nice 0day.
- n3rdy 14y agoHis naming conventions are splendid.
- verroq 14y agoNew Zealand represent.
- cortinaford 14y agoCVE-2013-2094
- deleted 14y ago[deleted]
- 0x0 14y agoThe debian security tracker claims squeeze is not vulnerable, so that's something... https://security-tracker.debian.org/tracker/CVE-2013-2094 https://security-tracker.debian.org/tracker/CVE-2013-2094
- wiredfool 14y agoUbuntu's bug: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1179943 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1179943
- wwdevries 14y agoTested the exploit on CentOS: Linux 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux (latest CentOS kernel): [user@centos ~]$ gcc -O2 exploit.c [user@centos ~]$ ./a.out 2.6.37-3.x x86_64 sd@fucksheep.org 2010 -sh-4.1#
- sspiff 14y agoI tested on two Ubuntu systems: * Linux beqbrgbrg1ux006.tpvision.com 3.2.0-29-generic #46-Ubuntu SMP Fri Jul 27 17:03:23 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux * Linux DrinkCoffee 3.5.0-25-generic #38-Ubuntu SMP Mon Feb 18 23:27:42 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux And the process gets killed because of a kernel oops in both.
- nathanb 14y agoTested on Arch Linux x64: [test@libros-dev tmp]$ uname -a Linux libros-dev 3.8.5-1-ARCH #1 SMP PREEMPT Fri Mar 29 19:18:14 CET 2013 x86_64 GNU/Linux [test@libros-dev tmp]$ ./a.out Killed This is in dmesg: [2112052.363397] Oops: 0000 [#1] PREEMPT SMP [2112052.363890] CPU 0 [2112052.363969] Pid: 3775, comm: a.out Not tainted 3.8.5-1-ARCH #1 innotek GmbH VirtualBox/VirtualBox
- Nux 14y agoIt's a great day to have kmod-tpe[1] installed. Having said that, after I rmmod-ed tpe the exploit still failed (I'm on 2.6.32-358.6.1.el6.x86_64): ./semtex 2.6.37-3.x x86_64 sd@fucksheep.org 2010 semtex: semtex.c:81: main: Assertion `p = memmem(code, 1024, &needle, 8)' failed. Aborted [1] - http://elrepo.org/tiki/kmod-tpe http://elrepo.org/tiki/kmod-tpe LE: exploit needs to be compiled with -O2 flags to work ...
- wwdevries 14y agoYou get this error when you compile the exploit incorrectly. Compile like this and it works: gcc -O2 semtex.c && ./a.out
- sagarun 14y agoDidn't work [user@host ~]$ uname -a Linux host.company.com 3.8.11-200.fc18.x86_64 #1 SMP Wed May 1 19:44:27 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux [user@host ~]$ gcc -O2 semtex.c && ./a.out a.out: semtex.c:51: sheep: Assertion `!close(fd)' failed. Aborted (core dumped)
- rei 13y agoMe too, didn't work: me@myServer:~$ uname -a Linux KALIDHCP 2.6.32-5-amd64 #1 SMP Mon Feb 25 00:26:11 UTC 2013 x86_64 GNU/Linux me@myServer:~$ cat /etc/debian_version 6.0.7 me@myServer:~$ gcc -O2 semtex.c me@myServer:~$ ./a.out a.out: semtex.c:51: sheep: Assertion `!close(fd)' failed. Aborted me@myServer:~$
- zokier 14y agoDoes this work against grsec kernel?
- Hello71 14y agoIt works unless you have active kernel exploit protection on, which kills all processes by any user causing "suspicious kernel crash" until reboot.
- peterwwillis 14y agoFor what it's worth, this causes my 3.2.29 64-bit Slack box to kernel panic. At least they can't do anything once they root it :>
- Thaxll 14y agoEdit: It does work on CentOS 6.3
- okamiueru 14y agoAlso works on CentOS 6.4. Linux XX 2.6.32-358.2.1.el6.x86_64 #1 SMP Wed Mar 13 00:26:49 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
- gtklocker 14y ago3.4.2-x86_64-linode25 doesn't seem to suffer from this. gunther> gcc -O2 semtex.c gunther> ./a.out a.out: semtex.c:63: main: Assertion `(map = mmap((void*)0x380000000, 0x010000000, 3, 0x32, 0,0)) == (void*)0x380000000' failed. Aborted gunther> uname -r 3.4.2-x86_64-linode25
- jaytaylor 14y ago3.5.2-linode45 also seems unaffected $ uname -a Linux li252-14 3.5.2-linode45 #1 SMP Wed Aug 15 14:10:55 EDT 2012 i686 i686 i386 GNU/Linux $ gcc -O2 semtex.c && ./a.out semtex.c: In function âfuckâ: semtex.c:30:37: warning: cast from pointer to integer of different size semtex.c:30:23: warning: cast to pointer from integer of different size semtex.c:31:21: warning: cast from pointer to integer of different size semtex.c:37:19: warning: cast to pointer from integer of different size semtex.c: In function âmainâ: semtex.c:74:3: warning: cast to pointer from integer of different size semtex.c:74:3: warning: cast to pointer from integer of different size a.out: semtex.c:51: sheep: Assertion `!close(fd)' failed. Aborted
- acher1 14y agoWorks in latest RHEL6.4 latest available kernel 2.6.32-358.6.1.el6.x86_64
- korethr 14y agoTesting this on various boxen I have immediate access to with kernel versions from 3.2, 3.5, 3.7 and 3.8, I get mixed results. On half of them it triggers a kernel bug, but gets killed before it can return a root shell, on the others it aborts without triggering a kernel bug. Either I'm rather lucky or this exploit is fragile. Perhaps both.
- druiid 14y agoJoy. This is going to be a big issue if the major distributions don't have a fixed kernel out in the next day or so (and then lazy admins don't remember to install it). I would guess anyone with an active php shell they haven't discovered before is going to have a Bad Time. Also, for any Redhat/CentOS users, here is bugzilla for this issue https://bugzilla.redhat.com/show_bug.cgi?id=962792 https://bugzilla.redhat.com/show_bug.cgi?id=962792
- alexjeffrey 14y agoon a somewhat related topic, the author of this has some issues he/she needs to work out. NSFW http://fucksheep.org/~sd/mspaint/ http://fucksheep.org/~sd/mspaint/
- staunch 14y agoStrange that the owner of fucksheep.org would be a bit of a deviant.
- snicklepuff 14y agoWhy the hell is CONFIG_PERF enabled in distribution kernels?? A normal server/desktop user would NEVER USE THAT. If you're smart enough to use Perf, you ought to be smart enough to compile your own kernel. This is a brilliant example of how stupid many distros are with their kernel configurations. They need to start understanding that enabling features that nobody uses only increases the probability of problematic bugs. Also, they need to stop enabling CONFIG_CC_STACKPROTECTOR. It slows stuff down, and as can be seen here, often doesn't do any good.
- e12e 14y agoFor those running Debian: https://security-tracker.debian.org/tracker/CVE-2013-2094 https://security-tracker.debian.org/tracker/CVE-2013-2094
- X4 14y agoDoes that work on a Hardened Gentoo Kernel too? 3.8.10
- X4 14y ago[NSFW Warning] hahahhahaha oh man.. that guy has a really funny pubertal pervert humor.. you shouldn't check the other folders on that server.
- thepumpkin1979 14y ago[NSFW] is this guy a kid? http://fucksheep.org/~sd/mspaint/ http://fucksheep.org/~sd/mspaint/
- yerlaw 14y agoHe assumes the system will have an executable named "bash". As this 0day is written, rename bash to sh and it will fail. Better yet, remove bash from your system and replace it with a simpler POSIX compliant sh. No respectable systemwide shell script should rely on bash anyway.
- fragmede 14y agoRedHat has a SystemTap fix available on their bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=962792#c13 https://bugzilla.redhat.com/show_bug.cgi?id=962792#c13
- nenolod 14y agoAlpine 2.4, 2.5 and 2.6 are not vulnerable even though PERF_EVENTS is enabled: [5126545.172128] BUG: unable to handle kernel paging request at ffffffff1de68048
- drill_sarge 14y agothe link to fucksheep.org is now marked as malicious by firefox lol
- bliaaaa 13y agono luck in centos 6.4 i686 [a@err ~]$ uname -a Linux err 2.6.32-358.6.1.el6.i686 #1 SMP Tue Apr 23 18:13:20 UTC 2013 i686 i686 i386 GNU/Linux [a@err ~]$ ./a.out a.out: 1.c:51: sheep: Assertion `!close(fd)' failed. Aborted (core dumped) [a@err ~]$