Re: [uml-devel] More security questions (was: Module exploits into the host?)

[BlaisorBlade <blaisorblade_spam@yahoo.it>]

Alle 00:14, giovedì 4 marzo 2004, Robin Green ha scritto:
> On Wed, Mar 03, 2004 at 10:29:59PM +0100, Henrik Nordstrom wrote:
> > On Wed, 3 Mar 2004, Robin Green wrote:
> > > Even with the skas patch, is it possible for an insmod to allow an
> > > attacker to break out of a UML?
> >
> > Yes.
>
> OK thanks.
>
> Two more security questions:
>
> 1. Has the lcall vulnerability been fixed? By a change in the mainline
> kernel?
>
> 2. I read on some mailing list (not this one) that in tt mode, processes
> within a UML instance can read and write to each other's memory! Ah, here
> we are, from last year:
>
> http://www.paul.sladen.org/vserver/archives/200305/0074.html
>
> Is this true, or just a rumour?
>
> I have a security proposal to post next, but first I want to understand the
> current state of play of UML security.
I think it can be true if you do not enable the "jail" mode. At least, in TT 
mode, without jail mode, any process can read the kernel memory; actually I 
don't think it can also read the other process memory *directly*, but it is 
possible if you can read the kernel datas you can get to do this (however not 
very simply).
-- 
Paolo Giarrusso, aka Blaisorblade
Linux registered user n. 292729



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id\x1470&alloc_id638&opÌk
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel