ช่องโหว่ใน Linux kernel 2.6 และ 2.4
Wojciech Purczynski จาก iSEC Security Research รายงานช่องโหว่ใน Linux kernel เวอร์ชั่น 2.6 และ 2.4 ในส่วนของ IA32 system call emulation ในแพลตฟอร์ม x86_64 ผู้โจมตีที่มีแอคเคาท์ภายในระบบอาจสามารถเอ็กซิคิวท์คำสั่งที่ต้องการได้โดยใช้สิทธิ์เดียวกับ Linux kernel ได้
รายละเอียดเพิ่มเติมรวมทั้งโค้ดที่ทดสอบ
[hide=2]===[ ABSTRACT ]=========================================================
Insufficient validation of general-purpose register in IA32 system call
emulation code may lead to local system compromise on x86_64 platform.
===[ AFFECTED SOFTWARE ]================================================
Linux 2.6
Linux 2.4
For the exact kernel version please refer to an information provided by
your vendor.
===[ DESCRIPTION ]======================================================
On x86_64 platform the Linux kernel supports compatibility emulation for
IA32 userland applications providing 32-bit system calls amongst other
32-bit resources.
As a result of arch/x86_64/ia32/ia32entry.S code optimization invalid
opcodes was used in the low level assembler routines providing
insufficient validation of %RAX register in the following part of code
(2.6):
---8<---
sysenter_do_call:
cmpl $(IA32_NR_syscalls-1),%eax
ja ia32_badsys
IA32_ARG_FIXUP 1
call *ia32_sys_call_table(,%rax,8)
---8<---
cstar_do_call:
cmpl $IA32_NR_syscalls-1,%eax
ja ia32_badsys
IA32_ARG_FIXUP 1
call *ia32_sys_call_table(,%rax,8)
---8<---
ia32_do_syscall:
cmpl $(IA32_NR_syscalls-1),%eax
ja ia32_badsys
IA32_ARG_FIXUP
call *ia32_sys_call_table(,%rax,8) # xxx: rip relative
---8<---
Improperly validated 64-bit values stored in the %RAX register may lead
to out-of-bounds system call table access resulting in the ability to
execute arbitrary code in the context of the Linux kernel.
===[ IMPACT ]===========================================================
Unprivileged local user may execute arbitrary code in the context of the
Linux kernel running on x86_64 platform.
===[ DISCLOSURE TIMELINE ]==============================================
18th September 2007 Vendor notification
24th September 2007 Public disclosure
===[ AUTHOR ]===========================================================
Wojciech Purczynski <cliph@research.coseinc.com>
Wojciech Purczynski is a Security Researcher at Vulnerability Research
Labs, COSEINC PTE Ltd. Wojciech Purczynski is also a member of iSEC
Security Research.
===[ LEGAL DISCLAIMER ]=================================================
Copyright
