黑客再爆Linux内核高危漏洞，一个命令可以攻击所有Linux系统，请尽快修复系统

yourantianya

原帖由 dbtwater 于 2009-8-18 14:30 发表
[test@test~]$ ./w*
-bash: ./w*: No such file or directory
[test@test~]$ sh
sh-3.2$ ./w*
sh: ./w*: No such file or directory
sh-3.2$



u ...

你先看清楚别人运行的命令是什么再吐

你什么都没有居然还运行这个命令？？

yourantianya

果然是可以提升至root权限

独孤九贱

原帖由 hackisle 于 2009-8-18 12:04 发表
static ssize_t sock_sendpage(struct file *file, struct page *page,
                             int offset, size_t size, loff_t *ppos, int more)
{
        struct socket *sock;
        int fla ...

楼上正解。不过按理来讲，这个漏洞如此简单和明显，为什么能潜伏如此之久呢？？？

tearboy

太可怕了，一下就获得权限了。
[abc@110qq wunderbar_emporium]$ ./w*
[+] MAPPED ZERO PAGE!
[+] Resolved selinux_enforcing to 0xc0828ff4
[+] Resolved selinux_enabled to 0xc0707060
[+] Resolved security_ops to 0xc0827524
[+] Resolved sel_read_enforce to 0xc04d1740
[+] Resolved audit_enabled to 0xc081bb24
[+] got ring0!
[+] detected 2.6 style 4k stacks
sh: mplayer: command not found
[+] Disabled security of : nothing, what an insecure machine!
[+] Got root!
sh-3.2# uname -a
Linux 110qq 2.6.23.1-42.fc8 #1 SMP Tue Oct 30 13:55:12 EDT 2007 i686 i686 i386 GNU/Linux

cygnusnow

不大懂。

hackisle

感觉应该是关注太少造成的，之前大家都在用溢出，很少注意到这类漏洞。

firecpk

流行的东东不一定就好!

luo118

测试结果是有。。。

vbs100

最新内核稳定版都已经解决这个bug了   
2.4.37.5， 2.6.30.5

commit de8a88319e1db92d7568323053316965c4b90660
Author: Greg Kroah-Hartman <gregkh@suse.de>
Date:   Sun Aug 16 14:19:38 2009 -0700

    Linux 2.6.30.5


commit d245fc6aa1bdaba06603d251e431f3d6d110a00a
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Aug 13 08:28:36 2009 -0700

    Make sock_sendpage() use kernel_sendpage()
   
    commit e694958388c50148389b0e9b9e9e8945cf0f1b98 upstream.
   
    kernel_sendpage() does the proper default case handling for when the
    socket doesn't have a native sendpage implementation.
   
    Now, arguably this might be something that we could instead solve by
    just specifying that all protocols should do it themselves at the
    protocol level, but we really only care about the common protocols.
    Does anybody really care about sendpage on something like Appletalk? Not
    likely.
   
    Acked-by: David S. Miller <davem@davemloft.net>
    Acked-by: Julien TINNES <julien@cr0.org>
    Acked-by: Tavis Ormandy <taviso@sdf.lonestar.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

[ 本帖最后由 vbs100 于 2009-8-18 20:50 编辑 ]

fangjiafu

太可怕了！！！