General

Russell Coker: Debian SE Linux and ssh-keysign-pwn

By Loading...

I just tested out the ssh-keysign-pwn exploit [1] on Debian kernel 6.12.74+deb13+1-amd64 which was released before these exploits. When sshkeysign_pwn is run as user_t the following is logged in the audit log and it fails to exploit anything: type=SYSCALL msg=audit(1778831599.951:22353257): arch=c000003e syscall=438 success=no exit=-1 a0=3 a1=c a2=0 a3=1b8020 items=0 ppid=5632 pid=6654 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=144 comm="sshkeysign_pwn" exe="/home/test/a/ssh-keysign-pwn/sshkeysign_pwn" subj=user_u:user_r:user_t:s0 key=(null)ARCH=x86_64 SYSCALL=pidfd_getfd AUID="test" UID="test" GID="test" EUID="test" SUID="test" FSUID="test" EGID="test" SGID="test" FSGID="test" type=PROCTITLE msg=audit(1778831599.951:22353257): proctitle="./sshkeysign_pwn" type=AVC…

Quelle: Originalartikel öffnen

AI Assistant
Context loaded: Russell Coker: Debian SE Linux and ssh-keysign-pwn