Messages in this thread | | | Subject | Re: [kernel] Question about 2.6.28 kernel | From | Alex <> | Date | Tue, 03 Feb 2009 15:22:08 +0100 |
| |
On Mon, 2009-02-02 at 21:12 +0100, Christian Kujau wrote: > On Mon, 2 Feb 2009, Alex wrote: > > kernel 2.6.28. Based on a simple rootkit, which can be executed on the > > 2.6.23, i got an "oops.. unable to handle kernel paging request at > > 0x...", when i run it on a new kernel. Can anyone help me finding what > > protection was added to prevent writings on kernel memory ? > > You could either post the Oops in full and discuss it right here on this > list or follow the Documentation/SecurityBugs document if this turns out > to be security related. >
Thanks for reply. Here is the post, it appears when i try to write into kernel memory. :
BUG: unable to handle kernel paging request at c0403cb8 IP: [<f86af074>] set_idt_handler+0xe/0x22 [module] *pde = 00911067 *pte = 00403161 Oops: 0003 [#1] SMP DEBUG_PAGEALLOC last sysfs file: /sys/devices/pci0000:00/0000:00:1d.7/usb2/2-4/dev Modules linked in: module(+) aes_i586 aes_generic arc4 ecb rt73usb rt2x00usb rt2x00lib rfkill mac80211 cfg80211 ext2 udf bridge stp bnep rfcomm l2cap bluetooth tun sunrpc cpufreq_ondemand acpi_cpufreq dm_mirror dm_region_hash dm_log dm_multipath dm_mod ipv6 snd_hda_intel snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss sr_mod cdrom snd_mixer_oss snd_pcm uvcvideo snd_timer snd_page_alloc snd_hwdep compat_ioctl32 firewire_ohci firewire_core video snd videodev i2c_i801 ata_piix battery output v4l1_compat ac sky2 crc_itu_t wmi serio_raw pata_acpi i2c_core soundcore joydev iTCO_wdt ata_generic iTCO_vendor_support sg ahci libata sd_mod scsi_mod ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: microcode]
Pid: 3887, comm: insmod Not tainted (2.6.28 #2) HP Pavilion dv2700 Notebook PC EIP: 0060:[<f86af074>] EFLAGS: 00210246 CPU: 0 EIP is at set_idt_handler+0xe/0x22 [module] EAX: c0403cbd EBX: c0403c88 ECX: c0781b04 EDX: 017d0000 ESI: f86af155 EDI: 00000000 EBP: f63d2fa0 ESP: f63d2e2c DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 Process insmod (pid: 3887, ti=f63d2000 task=f481be80 task.ti=f63d2000) Stack: f86af1b3 f86af2f0 c04371ea f86af2e3 c0652b00 f86af2d1 c0403b64 f86af2c0 f86af900 c0401130 00200286 c047f11d 00000044 f6201660 00000001 f63d2e7c c047f11d f63e6368 f63e6340 f86af900 f63d2e84 c047f16e f63d2fa0 c044d34f Call Trace: [<f86af1b3>] ? init_module+0x5e/0x6f [module] [<c04371ea>] ? sys_kill+0x0/0x12b [<c0403b64>] ? ia32_sysenter_target+0x0/0x7 [<c0401130>] ? _stext+0x48/0x119 [<c047f11d>] ? __vunmap+0x86/0x8e [<c047f11d>] ? __vunmap+0x86/0x8e [<c047f16e>] ? vfree+0x25/0x27 [<c044d34f>] ? load_module+0x1449/0x1616 [<c043d875>] ? autoremove_wake_function+0x0/0x33 [<c064d3a5>] ? _spin_lock+0x15/0x18 [<c04a093c>] ? mntput_no_expire+0x18/0x10e [<c049c81c>] ? dput+0xe9/0x13e [<c044d5a3>] ? sys_init_module+0x87/0x17a [<c0403bdf>] ? sysenter_do_call+0x12/0x2f Code: 6b f8 8b 50 03 83 c0 07 a3 90 0a 6b f8 eb 01 40 80 38 fa 75 fa a3 8c 0a 6b f8 89 d0 c3 eb 01 40 80 38 0f 75 fa 80 78 01 83 75 f4 <c6> 40 fb 68 eb 01 40 80 78 fc 0f 75 f9 80 78 fd 82 75 f3 c3 eb EIP: [<f86af074>] set_idt_handler+0xe/0x22 [module] SS:ESP 0068:f63d2e2c ---[ end trace d8513bd2111b2d4e ]---
Thanks in advance for any hints.
Alex
> Christian.
| |