vmsplice, an exploit to get root on Linux

Via Kriptópolis:

As many of you already know, a serious vulnerability has been discovered in the Linux kernel (2.6.x - 2.6.24.1) that lets a user with local access obtain root privileges by running a simple exploit.

Kriptópolis has more details, and a link to where the exploit source can be downloaded.

With this you can build a pretty destructive virus that attacks machines with this bug, something we discussed earlier.

Although the bug was quickly fixed (something common in the FOSS world), the problem, once again, is that users don’t keep their systems patched, and besides there are non-expert users who won’t know how to patch their kernel.

So if you are using Linux, check whether you are vulnerable to this exploit and apply the patches, and spread the word.

The bug fix is interesting for how simple it turns out to be: adding 3 lines to the file linux-2.6/fs/splice.c:

`@ -1237,6 +1237,9 @` static int get_iovec_page_array(const st  
if (unlikely(!base))  
break;  
  
bq. +	 if (unlikely(!access_ok(VERIFY_READ, base, len)))  
+	 break;  
+  
/*  
* Get this base offset and number of pages, then map  
* in the user pages.