| |||||||||||||
Privilege escalation vulnerability in the NVidia binary driverPrivilege escalation vulnerability in the NVidia binary driverPosted Aug 1, 2012 23:01 UTC (Wed) by THe_ZiPMaN (subscriber, #27460)In reply to: Privilege escalation vulnerability in the NVidia binary driver by corbet Parent article: Privilege escalation vulnerability in the NVidia binary driver
On Debian Unstable/Experimental, with kernel from siduction version 3.5-0.towo-siduction-amd64 and nvidia drivers from experimental version 304.30-1 it doesn't work...
$ ./a.out
On dmesg I can see...
[59253.807679] BUG: unable to handle kernel paging request at ffffffff81a00000
It seems to me that it's fixed at least with my combination of kernel/drivers.
(Log in to post comments)
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 1, 2012 23:15 UTC (Wed) by corbet (editor, #1) [Link] That is an oops listing. That doesn't say "fixed" to me at all; it says "the exploit doesn't quite work with this particular version of the kernel and the driver".
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 7:51 UTC (Thu) by THe_ZiPMaN (subscriber, #27460) [Link]
Yes, that was what I meant :)
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 10, 2012 8:48 UTC (Fri) by aigarius (subscriber, #7329) [Link]
The particular exploit code is not working anymore, but because there is an actual oops this means that the actual bug is not fixed and competent hackers can write a new exploit on the same bug. Or at least try to.
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 6:37 UTC (Thu) by Ricky123321 (guest, #86057) [Link]
Got the exact same behavior here on Squeeze but with kernel 3.2.0 amd64 and nvidia 295.59, both from the backports.
:(
Privilege escalation vulnerability in the NVidia binary driver Posted Aug 2, 2012 10:42 UTC (Thu) by PaXTeam (subscriber, #24616) [Link]
note the faulting insn: RIP: 0010:[<00000000004016a7>]
it's code in the *kernel's* code segment with a *userland* address (PaX/KERNEXEC and CR4.SMEP stop exactly this kind of exploit method, but this looks like a powerful bug, it could be exploited other ways). that is, the kernel is executing userland provided code, that's already proof for privilege escalation and the oops is due to the exploit's kernel payload not being bullet proof (something that's not hard to fix up, if that's your game).
|
|||||||||||||