Linux sock_sendpage() Local Root Exploit

/ Linux socksendpage NULL pointer dereference Copyright 2009 Ramon de Carvalho Valle This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your...

Linux Kernel 2.6.19 (x86x64) - udp_sendmsg Local Privilege Escalation (2)

Linux Kernel 2.6.19 x86x64 - udpsendmsg Local Privilege Escalation 2 / second verse, same as the first CVE-2009-2698 udpsendmsg, x86/x64 Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at NULL and finding it executed This exploit is a bit more nuanced and thoughtful ; use...

Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)

/ dedicated to my best friend in the whole world, Robin Price the joke is in your hands just too easy -- some nice library functions for reuse here though credits to julien tinnes/tavis ormandy for the bug may want to remove the attributeregparm3 for 2.4 kernels, I have no time to test...

Design/Logic Flaw

The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce usertransitiondeny and usertransitionallow rules for the 1 syssetfsuid and 2 syssetfsgid calls, which allows local users to bypass restrictions for those calls...

CVE-2008-1940

The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce usertransitiondeny and usertransitionallow rules for the 1 syssetfsuid and 2 syssetfsgid calls, which allows local users to bypass restrictions for those calls...

CVE-2008-1940

The vulnerability CVE-2008-1940 affects grsecurity RBAC before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2, where the RBAC feature fails to enforce user_transition_deny and user_transition_allow for the sys_setfsuid and sys_setfsgid calls. This allows local users to bypass restrictions on these calls. Th...

CVE-2008-1940

The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce usertransitiondeny and usertransitionallow rules for the 1 syssetfsuid and 2 syssetfsgid calls, which allows local users to bypass restrictions for those calls...

grsecurity RBAC本地绕过安全限制漏洞

BUGTRAQ ID: 28889 grsecurity是一组Linux内核补丁，用于提高安全性。 grsecurity的基于角色访问控制（RBAC）系统在强制usertransitiondeny和usertransitionallow规则时存在漏洞，允许本地用户在调用syssetfsuid和syssetfsgid期间绕过这些规则的限制，执行非授权操作。 grsecurity grsecurity Kernel Patch 2.6 grsecurity grsecurity Kernel Patch 2.4 grsecurity ----------...

CVE-2008-1940: Undefined Security Weakness

The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce usertransitiondeny and usertransitionallow rules for the 1 syssetfsuid and 2 syssetfsgid calls, which allows local users to bypass restrictions for those calls...

da-adv-01202007.txt

Digital Armaments advisory is 01.20.2007 http://www.digitalarmaments.com/2007200184936274.html I. Background grsecurity is an innovative approach to security utilizing a multi-layered detection, prevention, and containment model. It is licensed under the GPL. For further information or detail abo...

Digital Armaments Security Advisory 20.01.2007: Grsecurity Kernel PaX Vulnerability

Digital Armaments advisory is 01.20.2007 http://www.digitalarmaments.com/2007200184936274.html I. Background grsecurity is an innovative approach to security utilizing a multi-layered detection, prevention, and containment model. It is licensed under the GPL. For further information or detail abo...

grsecurity privilege escalation

Privilege escalation with expandstack...

Grsecurity Kernel PaX本地特权提升漏洞

Grsecurity Kernel PAX是一款Linux操作系统的内核安全加强补丁。 Grsecurity补丁中的expandstack存在未明错误，本地攻击者可以利用漏洞提升特权。 目前没有详细漏洞细节提供。 grsecurity grsecurity Kernel Patch 2.1.8 grsecurity grsecurity Kernel Patch 2.1.7 grsecurity grsecurity Kernel Patch 2.1.6 grsecurity grsecurity Kernel Patch 2.1.5 grsecurity grsecurity Kern...

CVE-2007-0257

Unspecified vulnerability in the expandstack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has...

CVE-2007-0253

Unspecified vulnerability in the grsecurity patch has unspecified impact and remote attack vectors, a different vulnerability than the expandstack vulnerability from the Digital Armaments 20070110 pre-advisory. NOTE: the grsecurity developer has disputed this issue, stating that "the function the...

Design/Logic Flaw

Unspecified vulnerability in the expandstack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has...

CVE-2007-0253

Unspecified vulnerability in the grsecurity patch has unspecified impact and remote attack vectors, a different vulnerability than the expandstack vulnerability from the Digital Armaments 20070110 pre-advisory. NOTE: the grsecurity developer has disputed this issue, stating that "the function the...

CVE-2007-0257

The CVE-2007-0257 entry concerns an unspecified vulnerability in the expand_stack function of grsecurity PaX that could allow local privilege escalation. Affected component is the expand_stack function; underlying root cause and concrete exploit vectors are not publicly detailed in the provided d...

CVE-2007-0257

Unspecified vulnerability in the expandstack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has...

CVE-2007-0257

Unspecified vulnerability in the expandstack function in grsecurity PaX allows local users to gain privileges via unspecified vectors. NOTE: the grsecurity developer has disputed this issue, stating that "the function they claim the vulnerability to be in is a trivial function, which can, and has...