[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20170628174537.GB16895@localhost.localdomain>
Date: Wed, 28 Jun 2017 10:45:37 -0700
From: Qualys Security Advisory <qsa@...lys.com>
To: oss-security@...ts.openwall.com
Subject: Re: Qualys Security Advisory - The Stack Clash
Hi all,
On Mon, Jun 26, 2017 at 02:35:57AM +0200, Solar Designer wrote:
> The decision to wait for fixes in major distros that almost certainly do
> intend to release fixes makes sense to me.
Thank you. Since Fedora and Slackware published their updates, and
FreeBSD and NetBSD published their patches (and our *BSD POCs are not
full-fledged exploits anyway), we attached our Stack Clash exploits and
POCs to this mail (alternatively, they are also available at
https://www.qualys.com/research/security-advisories/).
A few notes on the Linux ld.so exploits:
- Linux_ldso_dynamic's probability of success varies significantly from
one SUID binary to another, because it depends on the size of the
.dynamic, .data, and .bss sections of the SUID binary.
- Linux_ldso_hwcap's probability of success depends on the length of the
path to the SUID binary -- as a rule of thumb, the longer the path,
the higher the probability of success.
- On Fedora and CentOS, Linux_ldso_hwcap_64 may not work against
"short-path" SUID binaries, but it works against the "long-path" SUIDs
that are installed by default (for example,
/usr/lib/polkit-1/polkit-agent-helper-1).
Moreover, we wrote a quick-and-dirty version of this exploit that does
work against the SUIDs in /usr/bin (it does not hardcode the 96KB/32KB
sizes of argv[] pointers/free stack space, but instead optimizes these
sizes). However, we wanted to keep the main loop of this exploit as
simple as possible, and this improvement is therefore left as an
exercise for the interested reader.
We are at your disposal for questions, comments, and further
discussions. Thank you very much!
With best regards,
--
the Qualys Security Advisory team
Give 'Em Enough ROP
--The Clash, second studio album
View attachment "FreeBSD_CVE-2017-1085.c" of type "text/plain" (1947 bytes)
View attachment "FreeBSD_CVE-2017-FGPE.c" of type "text/plain" (2098 bytes)
View attachment "FreeBSD_CVE-2017-FGPU.c" of type "text/plain" (1852 bytes)
View attachment "Linux_ldso_dynamic.c" of type "text/plain" (18948 bytes)
View attachment "Linux_ldso_hwcap_64.c" of type "text/plain" (31921 bytes)
View attachment "Linux_ldso_hwcap.c" of type "text/plain" (33273 bytes)
View attachment "Linux_offset2lib.c" of type "text/plain" (5394 bytes)
View attachment "NetBSD_CVE-2017-1000375.c" of type "text/plain" (1529 bytes)
View attachment "OpenBSD_at.c" of type "text/plain" (18062 bytes)
View attachment "Solaris_rsh.c" of type "text/plain" (10686 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
