[UPDATE] The story of the Linux kernel 3.x…

The story of the Linux kernel 3.x…

In 2005 everybody was exited about possibility of bypass ASLR on all Linux 2.6 kernels because of the new concept called VDSO (Virtual Dynamic Shared Object). More information about this story can be found at the following link:

http://www.trilithium.com/johan/2005/08/linux-gate/

 

In short, VDSO was mmap’ed by the kernel in the user space memory always at the same fixed address. Because of that well-known technique ret-to-libc (or as some ppl prefer ROP) was possible and effective to bypass existing security mitigation in the system.

… 6 years later Linus Torvalds announced the release of the new kernel version – 3.x! Now, guess what happened…

pi3-darkstar new # uname -r

3.2.12-gentoo

pi3-darkstar new # cat /proc/sys/kernel/randomize_va_space

2

pi3-darkstar new # cat /proc/self/maps|tail -2

bfa81000-bfaa2000 rw-p 00000000 00:00 0          [stack]

ffffe000-fffff000 r-xp 00000000 00:00 0          [vdso]

pi3-darkstar new # cat /proc/self/maps|tail -2

bfd5e000-bfd7f000 rw-p 00000000 00:00 0          [stack]

ffffe000-fffff000 r-xp 00000000 00:00 0          [vdso]

pi3-darkstar new # ldd /bin/ls|head -1

    linux-gate.so.1 =>  (0xffffe000)

pi3-darkstar new # ldd /bin/ls|head -1

    linux-gate.so.1 =>  (0xffffe000)

pi3-darkstar new #

 

I’m not using

dd if=/proc/self/mem of=linux-gate.dso bs=4096 skip=1048574 count=1

because I’m lame 

pi3-darkstar new # echo "main(){}">dupa.c

pi3-darkstar new # gcc dupa.c -o dupa

pi3-darkstar new # gdb -q ./dupa

Reading symbols from /root/priv/projekty/pro-police/new/dupa...(no debugging symbols found)...done.

(gdb) b main

Breakpoint 1 at 0x80483b7

(gdb) r

Starting program: /root/priv/projekty/pro-police/new/dupa 

Breakpoint 1, 0x080483b7 in main ()

(gdb) dump binary memory test_dump.bin 0xffffe000 0xfffff000

(gdb) quit

A debugging session is active.

    Inferior 1 [process 20117] will be killed.

Quit anyway? (y or n) y

pi3-darkstar new # file test_dump.bin

test_dump.bin: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, stripped

Read more: pi3 blog

QR: 

Posted via email from Jasper-net