A 0-Day Local Privilege Escalation Bug Hits The Linux Kernel

[phoronix]

Phoronix: A 0-Day Local Privilege Escalation Bug Hits The Linux Kernel

CVE-2016-0728 is being made public today: a 0-day local privilege escalation vulnerability in the Linux kernel that's been present now for over three years...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-Kernel-2016-0-Day

[Pyth0n]

Hm...

[I]Linux PowerStation 4.4.0-gentoo #4 SMP Wed Jan 13 10:50:34 CET 2016 x86_64 Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz GenuineIntel GNU/Linux[/I]

No SElinux, no nothing. Just "strong" stack protection in-kernel (I guess irrelevant here), yet exploit does not work.

Ubuntu 14.04 and 16.04-a1 seem to be secure, too...

[exception0x876]

How do you know it does not work? Mine stuck forever in Increfing... phase

[chuckula]

Hm...

[I]Linux PowerStation 4.4.0-gentoo #4 SMP Wed Jan 13 10:50:34 CET 2016 x86_64 Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz GenuineIntel GNU/Linux[/I]

No SElinux, no nothing. Just "strong" stack protection in-kernel (I guess irrelevant here), yet exploit does not work.

Ubuntu 14.04 and 16.04-a1 seem to be secure, too...

You may have SMEP/SMAP enabled on your CPU that prevent this particular exploit from working properly (although a different attack program might be able to bypass those protections).

[Idonotexist]

Did you make sure to

grep -e "commit_cred" /boot/System.map-*
grep -e "prepare_kernel_cred" /boot/System.map-*

or the equivalent with /proc/kallsyms and edit the #define'd addresses before trying this exploit? Seems like an important part of the recipe.

Besides this exploit requires 2^32 system calls, which should plausibly take several minutes.

[bulletxt]

This is awful.

[magika]

And the funny thing is? The guilty line is a fucking GOTO.
Everyone using this atrocious coding practice should be shot in the head.

[Techwolf]

Does this mean good news for those trying to root there android phone?

[stevenc]

And the funny thing is? The guilty line is a fucking GOTO.

It's a pretty common pattern of trying to emulate Objected Oriented Programming in C. Try to construct one or more 'objects', otherwise fall back to one or more 'destructors' at end of the function.

They'd even implemented their own reference counters within the struct (object) and had function pointers (methods); both of which allowed this to be an exploitable bug. In OO languages these are implemented in the language/interpreter/compiler and usually done right.

[Ericg]

Does this mean good news for those trying to root there android phone?

Probably, yeah, though I don't know why Android's SELinux implementation isn't stopping this...