If you re running a 64bit system, and you ve got users with access to a video device (
/dev/video*), then be sure you update your kernels for
CVE-2010-2963. I ve been slowly making my way through auditing the many uses in the Linux kernel of the
copy_from_user() function, and ran into this vulnerability.
Here s the kernel code from
drivers/media/video/v4l2-compat-ioctl32.c:
static int get_microcode32(struct video_code *kp, struct video_code32 __user *up)
if (!access_ok(VERIFY_READ, up, sizeof(struct video_code32))
copy_from_user(kp->loadwhat, up->loadwhat, sizeof(up->loadwhat))
get_user(kp->datasize, &up->datasize)
copy_from_user(kp->data, up->data, up->datasize))
return -EFAULT;
return 0;
Note that
kp->data is being used as the target for
up->data in the final
copy_from_user() without actually verifying that
kp->data is pointing anywhere safe. Here s the caller of
get_microcode32:
static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
union
struct video_tuner vt;
struct video_code vc;
...
karg;
void __user *up = compat_ptr(arg);
...
switch (cmd)
...
case VIDIOCSMICROCODE:
err = get_microcode32(&karg.vc, up);
...
So, the contents of
up are totally under control of the caller, and the contents of
karg (in our case, the
video_code structure) are
not initialized at all. So, it seems like a call for
VIDIOCSMICROCODE would write
video_code->datasize bytes from
video_code->data into some random kernel address, just causing an Oops, since we don t control what is on the kernel s stack.
But wait, who says we can t control the contents of the kernel s stack? In fact, this compat function makes it extremely easy. Let s look back at the union. Notice the
struct video_tuner? That gets populated from the caller s
up memory via this case of the
switch (cmd) statement:
...
case VIDIOCSTUNER:
case VIDIOCGTUNER:
err = get_video_tuner32(&karg.vt, up);
...
So, to control the kernel stack, we just need to call this
ioctl twice in a row: once to populate the stack via
VIDIOCSTUNER with the contents we want (including the future address for
video_code->data, which starts at the same location as
video_tuner->name[20]), and then again with
VIDIOCSMICROCODE.
Tricks involved here are: the definition of the
VIDIOCSMICROCODE case in the kernel is wrong, and calling the
ioctls without any preparation can trigger other kernel work (memory faults, etc) that may destroy the stack contents. First, we need the real value for the desired case statement. This turns out to be 0 4020761b. Next, we just repeatedly call the setup
ioctl in an attempt to get incidental kernel work out of the way so that our last
ioctl doing the stack preparation will stick, and then we call the buggy
ioctl to trigger the vulnerability.
Since the ioctl already does a multi-byte copy, we can now copy arbitrary lengths of bytes into kernel memory. One method of turning an arbitrary kernel memory write into a privilege escalation is to overwrite a kernel function pointer, and trigger that function. Based on the
exploit for CVE-2010-3081, I opted to overwrite the
security_ops function pointer table. Their use of
msg_queue_msgctl wasn t very good for the general case since it s near the end of the table and its offset would depend on kernel versions. Initially I opted for
getcap, but in the end used
ptrace_traceme, both of which are very near the top the
security_ops structure. (Though I need share credit here with
Dan Rosenberg as we were working together on improving the reliability of the
security_ops overwrite method. He used the same approach for his excellent
RDS exploit.)
Here are the steps for one way of taking an arbitrary kernel memory write and turning it into a root escalation:
- overwrite
security_ops with default_security_ops, which will revert the LSM back to the capabilities-only security operations. This, however, means we can calculate where cap_ptrace_traceme is.
- overwrite
default_security_ops->ptrace_traceme to point to our supplied function that will actually perform the privilege escalation (thanks to Brad Spengler for his code from Enlightenment).
- trigger the function (in this case, call
ptrace(PTRACE_TRACEME, 0, NULL, NULL)).
- restore
default_security_ops->ptrace_traceme to point to cap_ptrace_traceme so the next caller doesn t Oops the system (since userspace memory will be remapped).
Here s the
source for
Vyakarana as seen
running in Enlightenment using
cap_getcap (which is pretty unstable, so you might want to switch it to use
ptrace_traceme), and as a
stand-alone memory writer.
Conclusions: Keep auditing the kernel for more arbitrary writes; I think there are still many left. Reduce the exploitation surface within the kernel itself (which
PaX and grsecurity have been doing for a while now), specifically:
- Block userspace memory access while in kernel mode. This would stop the ability to make the kernel start executing functions that live in userspace a clear privilege violation. This protection would stop the current exploit above, but the exploit could be adjusted to use kernel memory instead.
- Keep function pointers read-only. There is no reason for these function pointer tables (
fops, IDT, security_ops, etc) to be writable. These should all be marked correctly, with inline code exceptions being made for updating the global pointers to those tables, leaving the pointer read-only after it gets set. This would stop this particular exploit above, but there are still plenty more targets.
- Randomize the kernel stack location on a per-syscall basis. This will stop exploits that depend on a stable kernel stack location (as this exploit does).
As readers of my blog (who care about Debian stuff) may know, I've been
plugging away at the DHCP 4.x packages for some time now.
I first uploaded 4.1.1-P1-7 to unstable in early July, then -8 in mid-July
followed by -9 in late July.
The main reason for the delay (beyond my lack of spare time) was the
coordination with third-party packages that were plonking hooks into
/etc/dhcp3/dhclient- enter,exit -hooks.d. Once that got all squared
away, the
release team gave me the green light to upload to unstable. On the 26th
of July, 4.1.1-P1-9 made it into the testing distribution.
Rather unfortunately (for me), the release team then declared testing frozen
on August 6. I'd been hoping for a few more iterations on the package after
getting feedback from the testing user base. Alas, it was not to be.
One piece of feedback I did get on August 9 was release critical
bug #592361, which made me very sad, because I totally agreed with the
severity of it. It was an upstream issue, and I immediately escalated it to
upstream. Unfortunately, they did not get back to me particularly quickly (I
had to use some back channels to get a response at all).
I eventually got the response I was pretty much expecting: I was going to
have to directly patch configure.ac to make it stop trying to link
with libcrypto. To complicate matters, the LDAP patch also goes and messes
with configure.ac, so it required some fiddling with the LDAP patch
as well. I figured I could wrap my head around it all, it was just some
patch wrangling, but with parenthood and a wife who was trying to be a
full-time mother as well as a part-time student-by-correspondence, large
chunks of spare time were not in great abundance.
So I've had this bug niggling away at the back of my mind for literally
months now, when in sails
Simon McVittie with a patch. Hallelujah, I said to myself. I could just
take this guy's patch, and we'd all be home and hosed. So I spent a bunch of
hours yesterday, while I was at home trying to kick a cold, faffing around
with his patch and trying to get it to build.
Alas, it would not
build.
I went to bed far too late last night, feeling like I was on the verge of
having it work, but it wasn't. I emailed Simon back today, and he quickly
got back to me with the (easy) fix, and tonight, I am in business! The much
awaited 4.1.1-P1-10 is uploaded to unstable.
I'm still not particularly happy with the state of the package though. The
supplied dhclient-script doesn't properly support DHCPv6, and I'm
in no position to quickly rectify this, unfortunately, especially in light
of the freeze.
If you are interested in helping test pre-releases of an updated
dhclient-script, please feel free to subscribe to pkg-dhcp-devel@lists.alioth.debian.org,
and I'll coordinate such activities on that list in the near future.
While I have spent countless hours working on the new source format known as 3.0 (quilt) , I ve just realized that I have never blogged about its features and the reasons that lead me to work on it. Let s fix this.
The good old 1.0 format
Up to 2008, dpkg-source was only able to cope with a single source format (now named 1.0 ). That format was used since the inception of the project. While it worked fine for most cases, it suffered from a number of limitations mainly because it stored the Debian packaging files as a patch to apply on top of the upstream source tarball.
This patch can have two functions: creating the required files in the debian sub-directory and applying changes to the upstream sources. Over time, if the maintainer made several modifications to the upstream source code, they would end up entangled (and undocumented) in this single patch. In order to solve this problem, patch systems were created (dpatch, quilt, simple-patchsys, dbs, ) and many maintainers started using them. Each implementation is slightly different but the basic principle is always the same: store the upstream changes as multiple patches in the 
For some time now, we ve been gearing up to begin development on Ubuntu 11.04. While some folks have been putting the finishing touches on the 10.10 release, and bootstrapping the infrastructure for 11.04, others have been meeting with Canonical stakeholders, coordinating 
I recently uploaded new upstream versions of two neat small X tools to
Debian NYC will be holding a workshop next week: 
The big advantage of 
You can also disable virus live scan -- if you think it is safe!!!!
SSH
Using ssh under Windows is always a challenge. As a matter of fact, this tool doesn't match Windows context and it is not as integrated as in Linux/BSD.
There is 
After:
This has been merged in Emacs 24. You won't see any more ugly dashes in
graphical mode.
I've just fnished another step for new 
Buying a ThinkPad?
Don't buy one with
I finally bought myself an eBook reader. To be precise, I got the 
Well, recently I didn't had that much time to squash RC bugs 
Recently I've been producing simple Flash animations.
Mostly these are simple "Show an image, slide it around a bit, show another..". But I still feel vaguely unclean and non-free.
I started off using 
Another week has passed, where is Squeeze? Sadly, I did even less than the week before, but here is the log anyways: