|
|
|
Null pointer dereference vulnerability in the Linux kernel |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Null pointer dereference vulnerability in the Linux kernel Par DeobfuscatedLe [2010-05-12] à 14:10:26
Présentation : This is a really cool vulnerability that has been found by Eugene Kapun in the Linux kernel 2.6.30 . So, what is it Just a basic null pointer dereference in tun.c static unsigned int tun_chr_poll struct file file, poll_table wait struct tun_file tfile file-private_data struct tun_struct tun __tun_get tfile struct sock sk tun-sk unsigned int mask 0 if tun return POLLERR DBG KERN_INFO pourcentss tun_chr_poll n , tun-dev-name poll_wait file, tun-socket.wait, wait if skb_queue_empty tun-readq mask POLLIN POLLRDNORM if sock_writeable sk test_and_set_bit SOCK_ASYNC_NOSPACE, sk-sk_socket-flags sock_writeable sk mask POLLOUT POLLWRNORM if tun-dev-reg_state NETREG_REGISTERED mask POLLERR tun_put tun return mask Alright, the problem is not hard to spot. The code checks whether tun is null _after_ being initialized. Not good. But it's not exploitable, huh You're right, it's not... But here comes gcc optimization. Because tun has been initialized already, gcc just gets rid of the if tun ... which is correct in terms of optimization but also makes this vulnerability exploitable. Nice... More info and exploit here. Thanks to artyc for the heads-up
Les mots clés de la revue de presse pour cet article : pointer vulnerability linux kernel
Les videos sur SecuObs pour les mots clés : vulnerability linux
Les mots clés pour les articles publiés sur SecuObs : linux
Les éléments de la revue Twitter pour les mots clé : pointer vulnerability linux kernel
Les derniers articles du site "Deobfuscated" :
- Coloring junk code in IDA Pro
- Security Essentials Rogue AV Anti-Debugging
- More on moron packers and anti-debugging
- Big brother with big vulnerabilities...
- R.I.P milw0rm
- l0phtcrack 6 and Nmap 5 are out
- Null pointer dereference vulnerability in the Linux kernel
- Hey There's a worm in that apple
- Die Delphi, die
- And here comes another secure by design OS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.191.75.173 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.191.75.173 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
