oss-security - CVE request: kernel: /sys/kernel/debug/acpi/custom

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110225003225.GX4212@outflux.net>
Date: Thu, 24 Feb 2011 16:32:25 -0800
From: Kees Cook <kees@...ntu.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: /sys/kernel/debug/acpi/custom_method can bypass
 module restrictions

Hi,

While CVE-2010-4347 covers the unprivileged to fully privileged escalation
issue, this interface still allows an unprivileged root user to gain
back all their capabilities.

Having a system with acpi and debugfs built into the kernel allows
a uid=0 user (without capabilities, e.g. in containers) to write to
arbitrary kernel memory, likely resulting in escalated capability
privileges[1], or unlocking an otherwise modules-disabled kernel by
changing /proc/sys/kernel/modules_disabled back to 0.

Thanks,

-Kees

[1] http://jon.oberheide.org/files/american-sign-language.c

-- 
Kees Cook
Ubuntu Security Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.