oss-security - Re: lockdown bypass on mainline kernel for loading unsigned modules

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <206DB19C-0117-4F4B-AFF7-212E40CB8C75@oracle.com>
Date: Mon, 15 Jun 2020 17:22:27 +0100
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com, "Jason A. Donenfeld" <Jason@...c4.com>
Cc: linux-security-module@...r.kernel.org, linux-acpi@...r.kernel.org,
        Matthew Garrett <mjg59@...f.ucam.org>,
        kernel-hardening@...ts.openwall.com,
        Ubuntu Kernel Team <kernel-team@...ts.ubuntu.com>
Subject: Re: lockdown bypass on mainline kernel for loading
 unsigned modules

Hi Jason,


> On 15 Jun 2020, at 11:26, Jason A. Donenfeld <Jason@...c4.com> wrote:
> 
> Hi everyone,
> 
> Yesterday, I found a lockdown bypass in Ubuntu 18.04's kernel using
> ACPI table tricks via the efi ssdt variable [1]. Today I found another
> one that's a bit easier to exploit and appears to be unpatched on
> mainline, using acpi_configfs to inject an ACPI table. The tricks are
> basically the same as the first one, but this one appears to be
> unpatched, at least on my test machine. Explanation is in the header
> of the PoC:
> 
> https://git.zx2c4.com/american-unsigned-language/tree/american-unsigned-language-2.sh
> 
> I need to get some sleep, but if nobody posts a patch in the
> meanwhile, I'll try to post a fix tomorrow.
> 
> Jason
> 
> [1] https://www.openwall.com/lists/oss-security/2020/06/14/1


This looks CVE-worthy.   Are you going to ask for a CVE for it?

jch

Download attachment "signature.asc" of type "application/pgp-signature" (269 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.