[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <206DB19C-0117-4F4B-AFF7-212E40CB8C75@oracle.com>
Date: Mon, 15 Jun 2020 17:22:27 +0100
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com, "Jason A. Donenfeld" <Jason@...c4.com>
Cc: linux-security-module@...r.kernel.org, linux-acpi@...r.kernel.org,
Matthew Garrett <mjg59@...f.ucam.org>,
kernel-hardening@...ts.openwall.com,
Ubuntu Kernel Team <kernel-team@...ts.ubuntu.com>
Subject: Re: [oss-security] lockdown bypass on mainline kernel for loading
unsigned modules
Hi Jason,
> On 15 Jun 2020, at 11:26, Jason A. Donenfeld <Jason@...c4.com> wrote:
>
> Hi everyone,
>
> Yesterday, I found a lockdown bypass in Ubuntu 18.04's kernel using
> ACPI table tricks via the efi ssdt variable [1]. Today I found another
> one that's a bit easier to exploit and appears to be unpatched on
> mainline, using acpi_configfs to inject an ACPI table. The tricks are
> basically the same as the first one, but this one appears to be
> unpatched, at least on my test machine. Explanation is in the header
> of the PoC:
>
> https://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language-2.sh
>
> I need to get some sleep, but if nobody posts a patch in the
> meanwhile, I'll try to post a fix tomorrow.
>
> Jason
>
> [1] https://www.openwall.com/lists/oss-security/2020/06/14/1
This looks CVE-worthy. Are you going to ask for a CVE for it?
jch
Download attachment "signature.asc" of type "application/pgp-signature" (269 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
