PaX - Double-Mirrored VMA munmap Privilege Escalation

/ PaX double-mirrored VMA munmap local root exploit Copyright C 2005 Christophe Devine This exploit has only been tested on Debian 3.0 running Linux 2.4.29 patched with grsecurity-2.1.1-2.4.29-200501231159 $ gcc paxomatic.c $ ./chpax -m a.out $ ./a.out ... usage: ping -LRdfnqrv -c count -i wait -...

CVE-2005-0666

The CVE-2005-0666 entry describes an unknown vulnerability in PaX (Sept 2003 release to 2.2 before 2005.03.05) related to SEGMEXEC or RANDEXEC and VMA mirroring that allows local users and possibly remote attackers to bypass access restrictions and execute arbitrary code. The provided sources rei...

PaX non-executable memory protection privilege escalation

Bug in vma mirroring feature allows to execute code with privilege of the different application...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 2.1 are now available. The Linux kernel handles the basic functions of the operating system. This advisory includes fixes for the following security issues: iSEC Security Research discovered a VMA handling flaw i...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 2.1 are now available. The Linux kernel handles the basic functions of the operating system. This advisory includes fixes for the following security issues: iSEC Security Research discovered a VMA handling flaw i...

CVE-2004-1235

CVE-2004-1235 documents a race condition in the Linux kernel (load_elf_library and binfmt_aout paths used by uselib) affecting 2.4 (through 2.429-rc2) and 2.6 (through 2.6.10). Exploitation allows a local user to execute arbitrary code by manipulating the VMA descriptor. The initial description p...

CVE-2004-1235

Race condition in the 1 loadelflibrary and 2 binfmtaout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 3 are now available. The Linux kernel handles the basic functions of the operating system. This advisory includes fixes for several security issues: iSEC Security Research discovered a VMA handling flaw in the...

CVE-2004-0077

The domremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the domunmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different...

Linux kernel mremap(2) system call does not properly check return value from do_munmap() function

Overview A vulnerability in the Linux mremap2 system call could allow an authenticated, local attacker to execute arbitrary code with root privileges. Description The Linux kernel uses a linked list of vitrual memory area VMA descriptors to reference valid regions of the page table for a given...

CVE-2004-0077

The domremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the domunmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different...

mremap(2) full details available

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Synopsis: Linux kernel domremap VMA limit local privilege escalation vulnerability Product: Linux kernel Version: 2.2 up to and including 2.2.25, 2.4 up to to and including 2.4.24, 2.6 up to to and including 2.6.2 Vendor: http://www.kernel.org/ URL:...