Berkeley CSUA MOTD:Entry 12554
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/04/04 [General] UID:1000 Activity:popular
4/4     

2004/3/7-8 [Computer/SW/OS/Linux, Computer/SW/OS] UID:12554 Activity:very high
3/7     Major exploit found in Linux 2.6 kernel.  All versions prior to 2.6.3
        affected.  2.4 and 2.2 may be affected, I haven't bothered to look:
        http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt
        \_ This is a local exploit, for those who care.  It does affect
           Linux 2.4 and 2.2.
        \_ This is old news. It's the same vuln reported a few weeks ago,
           just with an exploit this time. People who have already upgraded
           to 2.4.25 or 2.6.3 don't need to worry about it.
           \_ are you sure?
              "Tested and known to be vulnerable kernel versions are all
               <= 2.2.25, <= 2.4.24 and <= 2.6.2. The 2.2.25 version of
               Linux kernel does not recognize the MREMAP_FIXED flag but
               this does not prevent the bug from being successfully
               exploited."
               \_ i said 2.4.25, not 2.2.25. i don't know anyone still
                  using 2.2.x.
                  \_ Oh, I am totally blind.. sorry.
2025/04/04 [General] UID:1000 Activity:popular
4/4     

You may also be interested in these entries...
2013/2/19-3/26 [Computer/SW/OS/OsX] UID:54611 Activity:nil
2/19    I program a lot by sshing to a Linux cluster.  So I'm used to using
        Xemacs to code.  This works fine from a Linux or Windows workstation,
        but sometimes I have to use a Mac.  On Mac, the meta is usually
        bound to option, but that often doesn't work over ssh for some reason.
        This makes using emacs a real pain.  Any suggestions on how to fix it?
        (Other than "use vi")
	...
2012/8/28-11/7 [Computer/HW/Memory] UID:54466 Activity:nil
8/26    Amazon medium instances (3.75GB RAM): 0.160/hour = $1382/year
        Generic standard Linux VPS (4GB RAM): $480/year
        Amazon costs more (but does offer superior scaling options).
        \_ Amazon is $670 if you buy a year's usage up front (heavy util).
           Why is heavy util less expensive than light util?
	...
2012/1/4-2/6 [Computer/HW/Drives] UID:54281 Activity:nil
1/4     I want to test how my servers behave during a disk failure and
        a RAID reconstruction so I want to simulate a hardware failure.
        How can I do this in Linux without having to physically pull
        a drive? These disks are behind a RAID card and run Linux. -ausman
        \_ According to the Linux RAID wiki, you might be able to use mdadm
           to do this with something like the following:
	...
2010/7/21-8/9 [Computer/SW/OS/FreeBSD] UID:53890 Activity:nil
7/21    Can I just use ifconfig to expand my netmask on a FreeBSD box?
        Are there any gotchas here? Linux forces me to restart my network
        to expand my netmask.
        \_ yes... and no, you don't have to restart your network on linux either
           \_ Rebooting is the Ubootntoo way!
              \_ Oooboot'n'tootin!
	...
2010/7/22-8/9 [Computer/SW/OS/FreeBSD, Computer/HW/Drives] UID:53893 Activity:nil
7/22    Playing with dd if=/dev/random of=/dev/<disk> on linux and bsd:
        2 questions, on linux when <disk>==hda it always gives me this off
        by one report i.e. Records out == records in-1 and says there is an
        error. Has anyone else seen this?  Second, when trying to repeat this
        on bsd, <disk>==rwd0 now, to my surprise, using the install disk and
        selecting (S)hell, when I try to dd a 40 gig disk it says "409 records
	...
2010/5/26-6/30 [Computer/SW/Unix/WindowManager, Computer/SW/OS/OsX] UID:53844 Activity:nil
5/26    anyone use lxde?  supposedly it is less stupid than xfce and
        less bloated than gnome.  thoughts?
        \_ lol, does anyone still use desktop linux?  Get with the times
           buy a mac.  Now.  DO IT.  Go NOW.
           \_ but we prefer herring to Kool-Aid
              \_ "you have to yell, he's hard of herring"
	...
2010/5/6-26 [Computer/SW/OS/Windows] UID:53818 Activity:low
5/5     Does anyone know how to do custom install of Ubuntu 10.04? I can't
        even boot it up to give me the menu to custom install and it
        keeps installing a bunch of crap I don't need. It's getting
        just as slow and bloated as Winblows install. Dear lord,
        I miss the old Ubuntu.
5/5=1.0 Numerology FTW.    5+5=10
	...
2010/4/22-5/10 [Computer/SW/Languages/Misc] UID:53797 Activity:nil
4/22    In Linux is there an easy way to rename the scripts in /etc/rc?.d ?
        For example I want to set all the /etc/rc?.d/S91apache to S100apache
        so that it'll run the ramdisk BEFORE going to apache.
        \_ Sure, just move them.
           \_ I mean is there a script that will rename all of them
              for me? Like: setrc apache2 0 0 1 1 1 1
	...
2011/11/29-2012/1/10 [Computer/HW/Printer] UID:54245 Activity:nil
11/29   HP printers might have a remote exploit that could set them on fire:
        http://preview.tinyurl.com/brh9bbq [ars technica]
        \_ Finally a use for the "printer on fire" error code!
           http://en.wikipedia.org/wiki/Lp0_on_fire
	...
2011/11/9-30 [Computer/SW/Security, Computer/SW/OS/OsX] UID:54219 Activity:nil
11/9    Unsigned code execution exploit in iOS 4.3 & 5:
        http://preview.tinyurl.com/bslubtu [arstechnica]
        \_ Fixed in iOS 5.0.1:
           http://preview.tinyurl.com/7l4vq52 [macobserver]
	...
2011/2/14-4/20 [Computer/SW/Unix] UID:54039 Activity:nil
2/14    You sure soda isn't running windows in disguise?  It would explain the
        uptimes.
        \_ hardly, My winbox stays up longer.
        \_ Nobody cares about uptime anymore brother, that's what web2.0 has
           taught us.  Everything is "stateless".
           \_ You;d think gamers would care more about uptime.
	...
2011/2/5-19 [Computer/SW/Languages/C_Cplusplus] UID:54027 Activity:nil
2/4     random C programming/linker fu question.  If I have
        int main() { printf("%s is at this adddr %p\n", "strlen", strlen); }
        and soda's /proc/sys/kernel/randomize_va_space is 2 (eg; on)
        why is strlen (or any other libc fn) at the same address every time?
        \_ I don't pretend to actually know the right answer to this, but
           could it have something to do with shared libraries?
	...
2010/3/12-30 [Computer/SW/OS/Windows] UID:53754 Activity:nil
3/12    When writing functions and structs in Windows user-mode and kernel-mode
        code, when do you use IN/OUT, when do you use __in/__out, and when do
        you not use either?  I'm confused.  Thanks in advance.
	...
2009/8/2-11 [Computer/SW/Unix] UID:53229 Activity:nil
8/1     What keeps hapening to soda? load of O(1000) then crash?  Is it
        still nfs, even past the new kernel we did just for nfs?
        \_ It's still NFS. Filer plz kthxbai.
           \_ Filer eliminates NFS?
	...
2009/7/26-29 [Computer/SW/Security] UID:53200 Activity:nil
7/25    so is this a remote ssh exploit ?
        http://users.volja.net/database/matasano.PNG
        \_ No but this is:
           soda> ssh anywhere
	...
2009/7/24-27 [Computer/SW/WWW/Browsers, Computer/SW/OS/OsX] UID:53191 Activity:kinda low
7/24    Firefox 3.5.1 on MacOS is a piece of crap. It crashes ALL THE TIME.
        It has crashed 3 or 4 times on me in the last hour, and not on
        the same pages either. The new Yahoo! home page also sucks ass.
        \_ os x keeps trashing my raid disk: '11 hours to rebuild. have fun
           with the kernel IO subsystem running like shit until then".
           Worthless piece of shit.
	...
2009/7/21-24 [Computer/SW/Languages/Java] UID:53168 Activity:moderate
7/20    For those who care btw, it looks like eclipse is now A Standard Tool
        at UCB ugrad cs, probably replaced emacs.  Furthermore, people get
        angry at seeing Makefiles, (since eclispe takes care of that).  I
        guess it's just a sign of the times.
        \_ The more people at my work use eclipse the less the code is
           managable in emacs.  I'm not sure which application's fault
	...
2009/7/8-16 [Computer/SW/OS/Linux, Computer/SW/Unix] UID:53124 Activity:nil
7/7     what happened to our web presence? http://www.csua.berkeley.edu
        not working
    \_ That would be because we've yet to set them up afaik. Steven *does* have
    a job after all. The idea is that we want a separate computer mounting the
    web directories, so that if an exploit compromises the webserver, the shell
    server (soda) itself will be insulated from the attack.
	...
2009/3/8-17 [Computer/SW/Unix] UID:52685 Activity:kinda low
3/8     I'm reading about an old exploit where someone used a buffer overflow
        in a printer daemon to get "daemon privileges," which allowed them
        to use another exploit on the mail delivery program to get root.  I'm
        not sure what daemon privileges are.  Is there some set of priveleges
        that most daemons run on that is higher than user but lower than root?
        What are they?  I've never heard this before.
	...
Cache (5986 bytes)
isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt
This bug is completely unrelated to the mremap bug disclosed on 05-01-2004 except concerning the same internal kernel function code. Details: The Linux kernel manages a list of user addressable valid memory locations on a per process basis. Every process owns a single linked list of so called virtual memory area descriptors called from now on just VMAs. Every VMA describes the start of a valid memory region, its length and moreover various memory flags like page protection. Every VMA in the list corresponds to a part of the processs page table. The page table contains descriptors in short page table entries PTEs of physical memory pages seen by the process. The VMA descriptor can be thus understood as a high level description of a particular region of the processs page table storing PTE properties like page R/W flag and so on. The mremap system call provides resizing shrinking or growing as well as moving of existing virtual memory areas or any of its parts across processs addressable space. Moving a part of the virtual memory from inside a VMA area to a new location requires creation of a new VMA descriptor as well as copying the underlying page table entries described by the VMA from the old to the new location in the processs page table. To accomplish this task the do_mremap code calls the do_munmap internal kernel function to remove any potentially existing old memory mapping in the new location as well as to remove the old virtual memory mapping. Unfortunately the code doesnt test the return value of the do_munmap function which may fail if the maximum number of available VMA descriptors has been exceeded. This happens if one tries to unmap middle part of an existing memory mapping and the processs limit on the number of VMAs has been reached which is currently 65535. One of the possible situations can be illustrated with the following picture. The corresponding page table entries PTEs have been marked with o and x: Before mremap: oooooooooooooooooooooooo xxxxxxxxxxxx -VMA1- -VMA2- REMAPPED-VMA new_len do_munmapcurrent-mm, addrnew_len, old_len - new_len; If the process now unmaps a sufficiently big area of memory covering those ownerless PTEs, the underlying page table frame will be inserted into the page table cache but will still contain valid PTEs. That means that on the next page table frame allocation inside process P for an address A our PTEs will appear in the page table of the process P! If that process tries to access the virtual memory at the address A there wont be also a page fault if the PTEs have appropriate read or write access rights. In other words: through the page table cache we are able to insert any data into the virtual memory space of another process. Our code takes the way through a setuid binary, however this is not the only one possibility. We prepare the page table cache so that there is a single empty page frame in front of the cache and then a special page table containing self executing pages. To fully understand how it works we must dig into the execve system call. If an user calls execve the kernel removes all traces of the current executable including the virtual memory areas and page tables allocated to the process. Then a new VMA for the stack on top of the virtual memory is created where the program environment and arguments to the new binary are stored they have been preserved in kernel memory. This causes a first page table frame to be allocated for the virtual memory region ranging from 0xbfc00000-0xc0000000. At this point the kernel does not allocate the underlying page tables. After doing some more work not important for the following the kernel transfers control to the dynamic linker to execute the binary. This causes a second page fault and triggers demand loading of the first code page of the dynamic linker. On a standard Linux kernel this will also allocate a page frame for the page table ranging from 0x40000000 to 0x40400000. On a kernel with page table cache enabled both allocations will take page frames from the cache first. That means that if the second page in the cached page list contains valid PTEs those could appear instead of the regular dynamic linker code. It is easy to place the PTEs so that they will shadow the code section of the dynamic linker. Note that the first PTE entry of a page is used by the cache code to maintain the page list. In our code we populate the page table cache with special frames containing PTEs to pages with a short shell code at the end of the page and fill the pages with a NOP landing zone. We must also mention that the first mremap hole disclosed on 05-01-2004 can be also very easily exploited through the page table cache. A second possibility to exploit the mremap bug is to create another VMA covering ownerless PTEs from a read-only file like /etc/passwd. Impact: Since no special privileges are required to use the mremap2 system call any process may use its unexpected behavior to disrupt the kernel memory management subsystem. Proper exploitation of this vulnerability leads to local privilege escalation giving an attacker full super-user privileges. The vulnerability may also lead to a denial-of-service attack on the available system memory. Tested and known to be vulnerable kernel versions are all has identified the vulnerability and performed further research. COPYING, DISTRIBUTION, AND MODIFICATION OF INFORMATION PRESENTED HERE IS ALLOWED ONLY WITH EXPRESS PERMISSION OF ONE OF THE AUTHORS. Disclaimer: This document and all the information it contains are provided as is, for educational purposes only, without warranty of any kind, whether express or implied. The authors reserve the right not to be responsible for the topicality, correctness, completeness or quality of the information provided in this document. Liability claims regarding damage caused by the use of any information provided, including any kind of information which is incomplete or incorrect, will therefore be rejected.