Russell Coker: Packet Edit Meme and Debian SE Linux

There’s yet another Linux kernel exploit based on container functions, here’s the result when run as user_t on a SE Linux system: $ ./packet_edit_meme [*] target /bin/su as uid 1000; entry at file offset 0x4340; shellcode 48 bytes unshare: Permission denied [-] page-cache corruption failed Here is the audit log entry for this failure: type=AVC msg=audit(1785640621.498:1843): avc: denied { create } for pid=1770 comm="packet_edit_mem" scontext=user_u:user_r:user_t:s0 tcontext=user_u:user_r:user_t:s0 tclass=user_namespace permissive=0 Here’s the result of running it from the unconfined_t domain: $ ./packet_edit_meme…

Quelle: Originalartikel öffnen