[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CADW8OBuTW4Mxpg_aqzZs=BeHw9V8syJr3xe=nWWY9C1B-zoA-w@mail.gmail.com>
Date: Thu, 11 Apr 2024 12:52:58 -0700
From: Kyle Zeng <zengyhkyle@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: New Linux LPE via GSMIOC_SETCONF_DLCI?
Notice that my previous analysis on YuriiCrimson's exploits is their
ExploitGSM_6_5 version.
I cannot make the ExploitGSM_5_15_to_6_1 version work in the latest
kernel in my test environment. However, this does not rule out the
possibility that it still works.
And the splash of the ExploitGSM_6_5 exploit is attached to the email.
Thanks,
Kyle Zeng
On Thu, Apr 11, 2024 at 12:25 PM Kyle Zeng <zengyhkyle@...il.com> wrote:
>
> Hi there,
>
> I just did some preliminary analysis on this.
> There are in fact three exploits involved in this.
> CVE-2023-6546: https://github.com/Nassim-Asrir/ZDI-24-020/
> jmpe4x's GSM exploit:
> https://github.com/jmpe4x/GSM_Linux_Kernel_LPE_Nday_Exploit
> YuriiCrimson's GSM exploit: https://github.com/YuriiCrimson/ExploitGSM
>
> I tested all of them. All of them targeted the same subsystem (GSM),
> used the same KASLR leak method ("/sys/kernel/notes"). But there are
> two vulnerabilities involved here.
> In short. jmpe4x's and YuriiCrimson's exploits are the same, but the
> vulnerability is not CVE-2023-6546.
> !!!!!!!!!!!!
> It is a 0day that is not patched in the main tree yet.
> Not a patch gap.
> !!!!!!!!!!!!
>
> My analysis is performed on the latest commit of Linus's tree:
> ```
> commit e8c39d0f57f358950356a8e44ee5159f57f86ec5 (HEAD -> master,
> origin/master, origin/HEAD)
> Merge: 03a55b63919 325f3fb551f
> Author: Linus Torvalds <torvalds@...ux-foundation.org>
> Date: Wed Apr 10 19:48:05 2024 -0700
> ```
>
> And jmpe4x's and YuriiCrimson's are exactly the same. The difference
> is mostly spaces. The diff is attached to this email.
>
> Thanks,
> Kyle Zeng
>
>
> On Thu, Apr 11, 2024 at 8:07 AM Dr. Christopher Kunz
> <info@...istopher-kunz.de> wrote:
> >
> > Hi,
> >
> > > There are two exploits in Yurii's repo above, according to Yurii for two
> > > different bugs. The above is one of them. Perhaps also try the other?
> > The two exploit versions are for different kernels. The 6.5 exploit
> > doesn't compile on the Debian 12 6.1 kernel, and no Debian version
> > currently distributes a 6.5 kernel, AFAICT. I used
> > ExploitGSM_5_15_to_6_1/ExploitGSM and it worked.
> > > I don't know, and apparently it'd need to be two CVEs for two bugs that
> > > Yurii exploits.
> > Possibly. I'm definitely out of my depth trying to analyze which bugs
> > are being exploited.
> > > CVE-2023-52564: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
> > > https://lists.openwall.net/linux-cve-announce/2024/03/02/54
> > >
> > > Maybe CVE-2023-52564 is one of the bugs Yurii exploits, or maybe not.
> > > I didn't look into this closely enough to tell.
> >
> > Apparently not. Debian 12 "Bookworm" currently runs this kernel:
> >
> > Linux debianexploitgsm 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian
> > 6.1.76-1 (2024-02-01) x86_64 GNU/Linux
> >
> > According to the changelog, this kernel has the fix for CVE-2023-52564
> > included:
> > - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
> > (from
> > https://metadata.ftp-master.debian.org/changelogs//main/l/linux-signed-amd64/linux-signed-amd64_6.1.76+1_changelog)
> >
> > Still, the exploit works, so it must exploit a different issue.
> >
> > Just my two cents,
> >
> > --cku
> >
View attachment "splash.txt" of type "text/plain" (7100 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
