[ / / / / / / / / / / / / / ] [ dir / drugs / girltalk / lit / scifi / vr ][Options][ watchlist ]

/tech/ - Technology

You can now write text to your AI-generated image at https://aiproto.com It is currently free to use for Proto members.
Name
Email
Subject
Comment *
File
Select/drop/paste files here
* = required field[▶ Show post options & limits]
Confused? See the FAQ.
Expand all images

Merry Christmas!

[–]

 No.842390>>842392 >>842394 [Watch Thread][Show All Posts]

Patch your kernel or get rekt, POC for ePBF kernel vuln

https://raw.githubusercontent.com/brl/grlh/master/get-rekt-linux-hardened.c

 No.842392>>842394 >>842399

>>842390 (OP)

>https://raw.githubusercontent.com/brl/grlh/master/get-rekt-linux-hardened.c

>exploit for counterfeit grsec kernels such as KSPP and linux-hardened

>This vulnerability CANNOT be exploited at all on authentic grsecurity kernel

gee, i wonder who could be behind this exploit. this vulnerability was fixed today anyway (CVE-2017-16995)


 No.842394

>>842392

>>842390 (OP)

msg("hammering cred structure at %llx\n", addr);

It's only street credz


 No.842399

>>842392

>CVE-2017-16995,CVE-2017-17862,CVE-2017-17863,CVE-2017-17864

woops, looks like there were multiple issues in the Extended BPF verifier

can be can be mitigated by:

>echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled

>sysctl kernel.unprivileged_bpf_disabled=1

without patching


 No.842407>>842408 >>842413

>Linux includes a BPF JIT compiler

>the Linux kernel includes an extended BPF virtual machine, termed extended BPF (eBPF).

Whose idea was it to put a JIT compiler and VM into the linux kernel?


 No.842408>>842410

>>842407

>Berkeley Packet Filter

Never heard of it. Does it filter UNIX sockets packets? Or is it something for iptables?


 No.842410>>842432

>>842408

Don't be lazy. Do some research for half an hour and then write a post about what you found out.


 No.842413

>>842407

The linux kernel has a few ASN.1 parsers at ring0 :D


 No.842432>>842477 >>842751

File (hide): d88aae74021340d⋯.jpg (13.86 KB, 214x317, 214:317, david-keith.jpg) (h) (u)

>>842410

Okay anon.

I found out that this BPF stuff has been around in one form or another since 1980.

>http://www.tcpdump.org/papers/bpf-usenix93.pdf

From what I can understand, is that Linux filters are similar enough to BSD filters, but they are 'simpler' in that a device does not need referenced to apply a filter.

>https://www.kernel.org/doc/Documentation/networking/filter.txt

I've also found that the BPF was always intended as a virtual machine, so the kernel must implement a virtual machine for the filtering mechanism itself.

This method of a virtual machine was a way to abrogate unnecessary copying of packets and buffers before any filter was applied.

And since it is a machine of its own, there needs to be something to compile or translate code from one machine language to another machine language; hence, the JIT compiler.

As for my question of if it filters Berkeley sockets' packets or INET packets, it can filter both, so it is useful for iptables and other firewalls. It seems that those firewalls are just an interface to the BPF at the low-level, and write the filters in the BPF language to be compiled by the JIT kernel compiler.

There is a lot in the tcpdump link that explains much of the theory and process behind BPF, but the kernel.org link provides the Linux implementation specifics and what deviates from the original paper.

As for the implication of this exploit, it seems that by controlling, exploiting, circumventing the BPF, an attacker could theoretically break through any firewall used.

For what it's worth.


 No.842477>>842557

>>842432

Any computer-level firewall. If I use my router's firewall you're still shit out of luck (unless my router is running linux with the same vuln, lol).


 No.842557

>>842477

TBH, I haven't looked much beyond the printf("cred") code.


 No.842751

File (hide): 225d585f05835e3⋯.jpg (62.64 KB, 640x853, 640:853, 1512895576344.jpg) (h) (u)

>>842432

>abrogate


 No.843030

So is this bad? It doesn't even have a fancy name.


 No.843065

Everything is getting pwnd lately, it's quite interesting. Something must've scared TPTB into going full 1984




[Return][Go to top][Catalog][Screencap][Nerve Center][Cancer][Update] ( Scroll to new posts) ( Auto) 5
13 replies | 2 images | Page ?
[Post a Reply]
[ / / / / / / / / / / / / / ] [ dir / drugs / girltalk / lit / scifi / vr ][ watchlist ]