4 ms·
On recent versions of Ubuntu, ordinary users do not by default have access to either System.map or any decompressed kernel images (I did however notice that on
by Aqwis 13y ago
On recent versions of Ubuntu, ordinary users do not by default have access to either System.map or any decompressed kernel images (I did however notice that on my RHEL system they have read access to System.map), and ptmx_fops does not appear in kallsyms. Is ensuring correct permissions on System.map and kernel images enough to render the exploit harmless?
Edit: On second thought, given that the kernel isn't custom, using files from another system with the same kernel is a trivial workaround.
- username42 13y agoRemoving read access gives an illusion of security. To avoid this false impression, it is better to leave the permissions.
- rwmj 13y agoRemoving read access is security by obscurity. You can grab the system map or kernel image from any Ubuntu repo. Even if it is a custom kernel, an exploit that can read kernel memory can search for kallsyms within the binary. I wrote code to do this once, it's quite fun.