lkml.org 
[lkml]   [2010]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking

* Ingo Molnar <mingo@elte.hu> wrote:

> If your claim that 'kernel version is needed at many places' is true then why am i
> seeing this on a pretty general distro box bootup:
>
> [root@aldebaran ~]# uname -a
> Linux aldebaran 2.6.99-tip-01574-g6ba54c9-dirty #1 SMP Sun Nov 7 10:24:38 CET 2010 x86_64 x86_64 x86_64 GNU/Linux
>
> ?
>
> Yes, some user-space might be unhappy if we set the version _back_ to say 2.4.0,
> but we could (as the patch below) fuzz up the version information from
> unprivileged attackers easily.

Btw., with an 'exploit honeypot' and 'version fuzzing' the uname output would look
like this to an unprivileged user:

$ uname -a
Linux aldebaran 2.6.99 x86_64 x86_64 x86_64 GNU/Linux

[ we wouldnt want to include the date or the SHA1 of the kernel, obviously. ]

And it would look like this to root:

# uname -a
Linux aldebaran 2.6.37-tip-01574-g6ba54c9-dirty #1 SMP Sun Nov 7 10:24:38 CET 2010 x86_64 x86_64 x86_64 GNU/Linux

Ingo


\
 
 \ /
  Last update: 2010-11-07 10:11    [W:0.102 / U:0.952 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site