Re: [kernel-hardening] On techniques for preventing commit_creds() user-space abuse

[Yves-Alexis Perez <corsac@debian.org>]

[-- Attachment #1: Type: text/plain, Size: 909 bytes --]

On jeu., 2015-11-26 at 00:14 +0100, Salva Peiró wrote:
> Given the typical path for kernel exploitation is the
> `commit_creds(prepare_kernel_cred(0))` being called from user space as
> detailed in [References].
> Why is not a check placed in commit_creds() that checks the return address
> of the call to ensure the call is a legit one coming from kernel space?.

I have the feeling that commit_creds(prepare_creds(0)) is just a quick way for
white hats / good guys to demonstrate a vulnerability by showing an exploit
leading to privilege escalation (or rooting Android devices).

As already said elsewere, we don't have much data on the exploitation
techniques used by real bad guys, but I somehow assume that if you have ring 0
access, the first things you do is disable existing protections and insert
kernel code in order to have free hands on userspace.

Regards,
-- 
Yves-Alexis


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 473 bytes --]