Kernel release status, StackProtector [LWN.net]

Kernel release status, StackProtector

Posted Sep 26, 2009 13:26 UTC (Sat) by spender (subscriber, #23067)
In reply to: Kernel release status, StackProtector by mingo
Parent article: Kernel release status

Here we go again with the contrived (and misleading) examples. You quote the config of FC12, a distro that hasn't even shipped yet.

How about something like FC11, a distro that does actually exist, which I exploited in my video with a fully patched system using their config?

How about the latest version of Ubuntu x64, a distro that does actually exist, which I exploited in my video with a fully patched system using their config?

Can you name *any* distro that isn't a contrived example of a beta distro no-one is using that actually enables this feature?

-Brad

(Log in to post comments)

Kernel release status, StackProtector

Posted Sep 26, 2009 13:41 UTC (Sat) by mingo (subscriber, #31122) [Link]

How about something like FC11, a distro that does actually exist, which I exploited in my video with a fully patched system using their config?

FYI, the latest update kernel for Fedora 11 is v2.6.30 - while the bug only exists in v2.6.31.

If you wanted bleeding edge v2.6.31 you could have gone to rawhide (like i did). There the bug was present but not exploitable as a local root hole due to StackProtector catching it.

Instead you chose to build your own v2.6.31 kernel for Fedora 11, using the v2.6.30 config - not the v2.6.31 rawhide config (which has stackprotector enabled).

That's how you were able to exploit it. Had you used the F11 kernel, or had you used the v2.6.31 rawhide kernel you'd not have been able to exploit it.

(Again - this does not remove anything from my (serious) responsibility over this bug. It just adds to the pool of information.)

Thanks,

Ingo