> > Recently multiple servers of the Debian project were compromised using a
> > Debian developers account and an unknown root exploit. Forensics
> > revealed a burneye encrypted exploit. Robert van der Meulen managed to
> > decrypt the binary which revealed a kernel exploit. Study of the exploit
> > by the RedHat and SuSE kernel and security teams quickly revealed that
> > the exploit used an integer overflow in the brk system call. Using
> > this bug it is possible for a userland program to trick the kernel into
> > giving access to the full kernel address space. This problem was found
> > in September by Andrew Morton, but unfortunately that was too late for
> > the 2.4.22 kernel release.
This is not an integer overflow bug. do_brk() doesn't verify its arguments
at all, allowing to create arbitrarily large virtual memory mapping (vma)
consuming kernel memory.
Regards,
wp
-- Wojciech Purczynski iSEC Security Research http://isec.pl/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.htmlReceived on Tue Dec 02 05:23:53 2003
This archive was generated by hypermail 2.1.8 : Tue Dec 02 2003 - 06:01:00 CST
