Using Kernel Exploits to Bypass Sandboxes for Fun and Profit

Researchers and attackers alike are quickly discovering you don’t need a fancy Java or Flash exploit to beat application sandboxes. Exploiting an unpatched kernel vulnerability in the underlying operating system, one that’s likely to stay unpatched for a long time, will do just fine. Twice this...

kernel: x86-64: seccomp: 32/64 syscall hole

The securecomputing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x8664 platform, when CONFIGSECCOMP is enabled, does not properly handle 1 a 32-bit process making a 64-bit syscall or 2 a 64-bit process making a 32-bit syscall, which allows...

CVE-2009-0835

The securecomputing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x8664 platform, when CONFIGSECCOMP is enabled, does not properly handle 1 a 32-bit process making a 64-bit syscall or 2 a 64-bit process making a 32-bit syscall, which allows...

Design/Logic Flaw

The securecomputing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x8664 platform, when CONFIGSECCOMP is enabled, does not properly handle 1 a 32-bit process making a 64-bit syscall or 2 a 64-bit process making a 32-bit syscall, which allows...

CVE-2009-0835

Summary (CVE-2009-0835) in the Linux kernel (2.6.28.7 and earlier on x86_64) describes a local privilege issue within the seccomp filter. The __secure_computing function does not correctly handle calls where a 32‑bit process makes a 64‑bit syscall or a 64‑bit process makes a 32‑bit syscall, allow...

CVE-2009-0835

The securecomputing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x8664 platform, when CONFIGSECCOMP is enabled, does not properly handle 1 a 32-bit process making a 64-bit syscall or 2 a 64-bit process making a 32-bit syscall, which allows...

Linux Kernel seccomp系统调用绕过安全限制漏洞

BUGTRAQ ID: 33948 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel内嵌有被称为seccomp的系统调用过滤技术，允许进程将其本身严格的限制到受限的系统调用集，如read、write、exit、sigreturn等。PRSETSECCOMP功能的实现中存在错误，允许本地用户通过将32位进程切换到64位模式并在64位进程中使用syscall指令或interrupt 80h绕过安全执行某些受限制的系统调用。 Linux kernel 2.6.x 厂商补丁： Linux -----...

Linux Kernel 2.6.x - seccomp System Call Security Bypass

Linux Kernel 2.6.x - seccomp System Call Security Bypass / source: https://www.securityfocus.com/bid/33948/info The Linux kernel is prone to a local security-bypass vulnerability. A local attacker may be able to exploit this issue to bypass access control and make restricted system calls, which m...

Linux Kernel 2.6.x - 'seccomp' System Call Security Bypass

/ source: https://www.securityfocus.com/bid/33948/info The Linux kernel is prone to a local security-bypass vulnerability. A local attacker may be able to exploit this issue to bypass access control and make restricted system calls, which may result in an elevation of privileges. / / test case fo...