[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <299a447a-3084-12c0-013f-b98162f365d1@linux.com>
Date: Fri, 9 Apr 2021 13:06:09 +0300
From: Alexander Popov <alex.popov@...ux.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: linux-distros@...openwall.org,
Linus Torvalds <torvalds@...uxfoundation.org>, Greg KH <greg@...ah.com>,
"security@...nel.org" <security@...nel.org>,
Norbert Slusarek <nslusarek@....net>,
Stefano Garzarella <sgarzare@...hat.com>, Eric Dumazet
<edumazet@...gle.com>, Anthony Liguori <aliguori@...zon.com>,
David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
Jorgen Hansen <jhansen@...are.com>,
Stefan Schmidt <stefan@...enfreihafen.org>,
Jeff Vander Stoep <jeffv@...gle.com>,
Andrey Konovalov <andreyknvl@...gle.com>
Subject: Re: Linux kernel: Exploitable vulnerabilities in AF_VSOCK
implementation
Hello!
I published a detailed article about exploiting CVE-2021-26708 in AF_VSOCK
implementation: https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html
In this article I describe how to gain local privilege escalation on Fedora 33
Server for x86_64, bypassing SMEP and SMAP.
The race condition may cause write-after-free of a 4-byte controlled value to a
64-byte kernel object at offset 40. That's quite limited memory corruption. I
had a hard time turning it into arbitrary read/write of kernel memory.
In this article I also describe possible exploit mitigations that could prevent
exploitation of CVE-2021-26708 or at least make it harder.
Best regards,
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
