Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Linux kernel PRCTL local privilege escalation - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Linux kernel PRCTL local privilege escalation
This vulnerability enables an attacker to get elevated privileges on a local machine. There have been several exploits released and we can confirm that they work. We've tested this on unpatched SuSE and RedHat Enterprise Linux machines:

$ ./a.out

prctl() suidsafe exploit

(C) Julien TINNES

[+] Installed signal handler
[+] We are suidsafe dumpable!
[+] Malicious string forged
[+] Segfaulting child
[+] Waiting for exploit to succeed (~28 seconds)
[+] getting root shell
sh-3.00#

Debian also confirmed that this exploit was used on their recently compromised machine (http://isc.sans.org/diary.php?storyid=1479).

As all kernels 2.6.13 up to version 2.6.17.4 and 2.6.16 before 2.6.16.24 are affected, you should patch as soon as possible, even if you don't allow any local users on your machines. Remember that even a small vulnerability in a PHP script can allow local access, which then can be escalated with this exploit.

CVE for this vulnerability has also been issued: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2451.

Thanks to David Taylor for sending information about this to us.
I will be teaching next: Web App Penetration Testing and Ethical Hacking - Cloud Security Summit & Training 2019

Bojan

376 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!