All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Valdis Klētnieks" <valdis.kletnieks@vt.edu>
To: John Wood <john.wood@gmx.com>
Cc: kernelnewbies@kernelnewbies.org, Andi Kleen <ak@linux.intel.com>,
	Kees Cook <keescook@chromium.org>,
	kernel-hardening@lists.openwall.com
Subject: Re: Notify special task kill using wait* functions
Date: Wed, 07 Apr 2021 16:38:46 -0400	[thread overview]
Message-ID: <184666.1617827926@turing-police> (raw)
In-Reply-To: <20210407175151.GA3301@ubuntu>

[-- Attachment #1: Type: text/plain, Size: 907 bytes --]

On Wed, 07 Apr 2021 19:51:51 +0200, John Wood said:

> When brute detects a brute force attack through the fork system call
> (killing p3) it will mark the binary file executed by p3 as "not allowed".
> From now on, any execve that try to run this binary will fail. This way it
> is not necessary to notify nothing to userspace and also we avoid an exec
> brute force attack due to the respawn of processes [2] by a supervisor
> (abused or not by a bad guy).

You're not thinking evil enough. :)

I didn't even finish the line that starts "From now on.." before I started
wondering "How can I abuse this to hang or crash a system?"  And it only took
me a few seconds to come up with an attack. All you need to do is find a way to
sigsegv /bin/bash... and that's easy to do by forking, excecve /bin/bash, and
then use ptrace() to screw the child process's stack and cause a sigsegv.

Say goodnight Gracie...

[-- Attachment #2: Type: application/pgp-signature, Size: 832 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: "Valdis Klētnieks" <valdis.kletnieks@vt.edu>
To: John Wood <john.wood@gmx.com>
Cc: kernel-hardening@lists.openwall.com,
	Andi Kleen <ak@linux.intel.com>,
	Kees Cook <keescook@chromium.org>,
	kernelnewbies@kernelnewbies.org
Subject: Re: Notify special task kill using wait* functions
Date: Wed, 07 Apr 2021 16:38:46 -0400	[thread overview]
Message-ID: <184666.1617827926@turing-police> (raw)
In-Reply-To: <20210407175151.GA3301@ubuntu>


[-- Attachment #1.1: Type: text/plain, Size: 907 bytes --]

On Wed, 07 Apr 2021 19:51:51 +0200, John Wood said:

> When brute detects a brute force attack through the fork system call
> (killing p3) it will mark the binary file executed by p3 as "not allowed".
> From now on, any execve that try to run this binary will fail. This way it
> is not necessary to notify nothing to userspace and also we avoid an exec
> brute force attack due to the respawn of processes [2] by a supervisor
> (abused or not by a bad guy).

You're not thinking evil enough. :)

I didn't even finish the line that starts "From now on.." before I started
wondering "How can I abuse this to hang or crash a system?"  And it only took
me a few seconds to come up with an attack. All you need to do is find a way to
sigsegv /bin/bash... and that's easy to do by forking, excecve /bin/bash, and
then use ptrace() to screw the child process's stack and cause a sigsegv.

Say goodnight Gracie...

[-- Attachment #1.2: Type: application/pgp-signature, Size: 832 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

  reply	other threads:[~2021-04-07 20:39 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-30 17:34 Notify special task kill using wait* functions John Wood
2021-03-30 18:40 ` Valdis Klētnieks
2021-04-02 12:49   ` John Wood
2021-04-03  3:50     ` Valdis Klētnieks
2021-04-03  7:02       ` John Wood
2021-04-03 21:34         ` Valdis Klētnieks
2021-04-04  9:48           ` John Wood
2021-04-04 21:10             ` Valdis Klētnieks
2021-04-05  7:31               ` John Wood
2021-04-06 23:55                 ` Valdis Klētnieks
2021-04-07 17:51                   ` John Wood
2021-04-07 17:51                     ` John Wood
2021-04-07 20:38                     ` Valdis Klētnieks [this message]
2021-04-07 20:38                       ` Valdis Klētnieks
2021-04-08  1:51                       ` Andi Kleen
2021-04-08  1:51                         ` Andi Kleen
2021-04-09 14:29                         ` John Wood
2021-04-09 14:29                           ` John Wood
2021-04-09 15:06                           ` Andi Kleen
2021-04-09 15:06                             ` Andi Kleen
2021-04-09 16:08                             ` John Wood
2021-04-09 16:08                               ` John Wood
2021-04-09 23:28                             ` Valdis Klētnieks
2021-04-09 23:28                               ` Valdis Klētnieks
2021-04-11  8:46                               ` John Wood
2021-04-11  8:46                                 ` John Wood

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=184666.1617827926@turing-police \
    --to=valdis.kletnieks@vt.edu \
    --cc=ak@linux.intel.com \
    --cc=john.wood@gmx.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=kernelnewbies@kernelnewbies.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.