Messages in this thread | | | From | "Gilles Espinasse" <> | Subject | Re: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking | Date | Sat, 13 Nov 2010 14:06:00 +0100 |
| |
----- Original Message ----- From: "Ingo Molnar" <mingo@elte.hu> To: "Willy Tarreau" <w@1wt.eu> Cc: "Marcus Meissner" <meissner@suse.de>; <security@kernel.org>; <mort@sgi.com>; "Peter Zijlstra" <a.p.zijlstra@chello.nl>; <fweisbec@gmail.com>; "H. Peter Anvin" <hpa@zytor.com>; <linux-kernel@vger.kernel.org>; <jason.wessel@windriver.com>; <tj@kernel.org>; <Andrew@zimbra8-e1.priv.proxad.net>; <"Morton <"@zimbra8-e1.priv.proxad.net> Sent: Sunday, November 07, 2010 10:08 AM Subject: Re: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking
> > * Ingo Molnar <mingo@elte.hu> wrote: > > > If your claim that 'kernel version is needed at many places' is true then why am i > > seeing this on a pretty general distro box bootup: > > > > [root@aldebaran ~]# uname -a > > Linux aldebaran 2.6.99-tip-01574-g6ba54c9-dirty #1 SMP Sun Nov 7 10:24:38 CET 2010 x86_64 x86_64 x86_64 GNU/Linux > > > > ? > > > > Yes, some user-space might be unhappy if we set the version _back_ to say 2.4.0, > > but we could (as the patch below) fuzz up the version information from > > unprivileged attackers easily. > > Btw., with an 'exploit honeypot' and 'version fuzzing' the uname output would look > like this to an unprivileged user: > > $ uname -a > Linux aldebaran 2.6.99 x86_64 x86_64 x86_64 GNU/Linux > > [ we wouldnt want to include the date or the SHA1 of the kernel, obviously. ] > > And it would look like this to root: > > # uname -a > Linux aldebaran 2.6.37-tip-01574-g6ba54c9-dirty #1 SMP Sun Nov 7 10:24:38 CET 2010 x86_64 x86_64 x86_64 GNU/Linux > > Ingo
A bit late comment gesp@a7n8x-e:~$ strings /lib/modules/*/kernel/drivers/scsi/in2000.ko | grep 2010 Sep 16 2010 gesp@a7n8x-e:~$ strings /lib/modules/*/kernel/drivers/char/nozomi.ko | grep 2010 Nozomi driver 2.1d (build date: Sep 16 2010 19:01:27) gesp@a7n8x-e:~$ uname -a Linux a7n8x-e 2.6.26-2-686 #1 SMP Thu Sep 16 19:35:51 UTC 2010 i686 GNU/Linux
Should it not be considered before to remove __DATE__ and __TIME__ from module code? That would have too the good effect that everyone that compile same code with same compiler get exactly same file.
Gilles
| |