> > Recently multiple servers of the Debian project were compromised using a > > Debian developers account and an unknown root exploit. Forensics > > revealed a burneye encrypted exploit. Robert van der Meulen managed to > > decrypt the binary which revealed a kernel exploit. Study of the exploit > > by the RedHat and SuSE kernel and security teams quickly revealed that > > the exploit used an integer overflow in the brk system call. Using > > this bug it is possible for a userland program to trick the kernel into > > giving access to the full kernel address space. This problem was found > > in September by Andrew Morton, but unfortunately that was too late for > > the 2.4.22 kernel release.
This is not an integer overflow bug. do_brk() doesn't verify its arguments at all, allowing to create arbitrarily large virtual memory mapping (vma) consuming kernel memory. Regards, wp -- Wojciech Purczynski iSEC Security Research http://isec.pl/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
