[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <52D2F2A9.50208@halfdog.net>
Date: Sun, 12 Jan 2014 19:53:13 +0000
From: halfdog <me@...fdog.net>
To: oss-security@...ts.openwall.com
Subject: Linux kernel: missing CPU-state sanitation during task-switch causes
DOS / privilege escalation
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello list,
Although of low impact (only some processors/kernels affected,
escalation currently only with mmap_min_addr=0), this might still be
CVE-worthy:
Faults during task-switch due to unhandled FPU-exceptions allow to
kill processes at random on all affected kernels, resulting in local
DOS in the end. One some architectures, privilege escalation under
non-common circumstances is possible, POC for escalation via
shmem_xattr_handlers is available for about 5 days.
See [1] for information about discovery, exploitation, [2] about LKML
discussion, [3] for patch.
hd
[1] http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/
[2] https://lkml.org/lkml/2013/12/28/95
[3]
http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?id=26bef1318adc1b3a530ecc807ef99346db2aa8b0
- --
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlLS8q4ACgkQxFmThv7tq+5O2ACeJ2spKwVgWhLSklOtg7WlvkIl
wXMAn1Mn/9vrQPlMP53zdL/XmXLrCsIu
=ObvK
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
