Weekly Edition
Return to the Security page
| |||||||||||||
Privilege escalation vulnerability in the NVidia binary driver
People running the proprietary NVidia graphics driver on systems with untrusted
users may want to have a look at this
exploit posted by Dave Airlie. "I was given this anonymously, it
has been sent to nvidia over a month ago with no reply or advisory and the
original author wishes to remain anonymous but would like to have the
exploit published at this time."
(Log in to post comments)
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 15:20 UTC (Wed) by flammon (guest, #807) [Link]
That's one way to filter out the script kiddies lol.
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 17:40 UTC (Wed) by HelloWorld (guest, #56129) [Link]
> That's one way to filter out the script kiddies
A rather ineffective one though. Current versions of GNU rm will only print this: > rm: it is dangerous to operate recursively on `/' > rm: use --no-preserve-root to override this failsafe
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 20:53 UTC (Wed) by ken (subscriber, #625) [Link]
Really that is great.
having tried to compile a broadcom kernel that modified the makefile so it needed an ENV variable that I had not set and thus having a make clean resulting in a recursive clean of /. I do see the usefulness of having a extra check on /.
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 21:08 UTC (Wed) by HelloWorld (guest, #56129) [Link]
Don't compile as root.
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 18:22 UTC (Thu) by jengelh (subscriber, #33263) [Link]
And with Open Build Service, you also get free isolation, starting from chroots, up to xen and kvm isolated instances.
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 9, 2012 16:11 UTC (Thu) by philomath (guest, #84172) [Link]
Reminds me of:
>Q:
>I'm having problems with my Windows software. Will you help me?
>A:
>Yes. Go to a DOS prompt and type "format c:". Any problems you are experiencing will cease within a few minutes.
(esr in "How To Become A Hacker).
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 16:19 UTC (Wed) by bros (subscriber, #75198) [Link]
Is this related:
http://nvidia.custhelp.com/app/answers/detail/a_id/3109
Seems to be fixed, isn't it? :)
Privilege escalation vulnerability in the NVidia binary driver
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 23:01 UTC (Wed) by THe_ZiPMaN (subscriber, #27460) [Link]
On Debian Unstable/Experimental, with kernel from siduction version 3.5-0.towo-siduction-amd64 and nvidia drivers from experimental version 304.30-1 it doesn't work...
$ ./a.out
On dmesg I can see...
[59253.807679] BUG: unable to handle kernel paging request at ffffffff81a00000
It seems to me that it's fixed at least with my combination of kernel/drivers.
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 23:15 UTC (Wed) by corbet (editor, #1) [Link] That is an oops listing. That doesn't say "fixed" to me at all; it says "the exploit doesn't quite work with this particular version of the kernel and the driver".
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 7:51 UTC (Thu) by THe_ZiPMaN (subscriber, #27460) [Link]
Yes, that was what I meant :)
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 10, 2012 8:48 UTC (Fri) by aigarius (subscriber, #7329) [Link]
The particular exploit code is not working anymore, but because there is an actual oops this means that the actual bug is not fixed and competent hackers can write a new exploit on the same bug. Or at least try to.
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 6:37 UTC (Thu) by Ricky123321 (guest, #86057) [Link]
Got the exact same behavior here on Squeeze but with kernel 3.2.0 amd64 and nvidia 295.59, both from the backports.
:(
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 10:42 UTC (Thu) by PaXTeam (subscriber, #24616) [Link]
note the faulting insn: RIP: 0010:[<00000000004016a7>]
it's code in the *kernel's* code segment with a *userland* address (PaX/KERNEXEC and CR4.SMEP stop exactly this kind of exploit method, but this looks like a powerful bug, it could be exploited other ways). that is, the kernel is executing userland provided code, that's already proof for privilege escalation and the oops is due to the exploit's kernel payload not being bullet proof (something that's not hard to fix up, if that's your game).
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 11:10 UTC (Thu) by bush (guest, #86065) [Link]
Set NVreg_ModifyDeviceFiles to 0 can deny common user direct access /dev/nvidia0.
If it set, you can see "direct rendering: No" in glxinfo. But it will make gdm cannot start at some distribution.
Centos 6.3 64bit with nvidia 295.59 will exit after print [*] Abusing nVidia... without other message.
|
|||||||||||||