Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5075 > unrolled thread

vulnerability in 8.6

Back to article view | Back to linux.debian.security

Contents

  vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 17:00 +0100
    Re: vulnerability in 8.6 Richard van den Berg <richard@vdberg.org> - 2016-11-07 17:20 +0100
    Re: vulnerability in 8.6 Salvatore Bonaccorso <carnil@debian.org> - 2016-11-07 17:20 +0100
      Re: vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 17:50 +0100
        Re: vulnerability in 8.6 Nicholas Luedtke <nicholas.luedtke@hpe.com> - 2016-11-07 18:00 +0100
          Re: vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 18:10 +0100
            Re: vulnerability in 8.6 Matias Mucciolo <mmucciolo@suteba.org.ar> - 2016-11-07 18:10 +0100
            Re: vulnerability in 8.6 Andrew Deck <andrew.hastings.deck@gmail.com> - 2016-11-07 18:20 +0100
        Re: vulnerability in 8.6 Matias Mucciolo <mmucciolo@suteba.org.ar> - 2016-11-07 18:00 +0100
        Re: vulnerability in 8.6 Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2016-11-07 18:20 +0100
          Re: vulnerability in 8.6 Mike Oliver <mike@mopmeat.net> - 2016-11-07 18:30 +0100
            Re: vulnerability in 8.6 Ozgur <okaratas@member.fsf.org> - 2016-11-07 20:00 +0100
          Re: vulnerability in 8.6 Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2016-11-07 20:00 +0100
      Re: vulnerability in 8.6 Richard Waterbeek <richardwbb@versatel.nl> - 2016-11-10 03:40 +0100
        Re: vulnerability in 8.6 Vladislav Kurz <vladislav.kurz@webstep.net> - 2016-11-10 10:30 +0100
          Re: vulnerability in 8.6 Richard Waterbeek <richardwbb@versatel.nl> - 2016-11-16 21:30 +0100
            Re: vulnerability in 8.6 Salvatore Bonaccorso <carnil@debian.org> - 2016-11-16 21:40 +0100
        Re: vulnerability in 8.6 advocatux <advocatux@gmail.com> - 2016-11-10 10:50 +0100
          Re: vulnerability in 8.6 Tino <tinolin2010@gmail.com> - 2016-11-10 14:00 +0100
      Re: vulnerability in 8.6 Richard Waterbeek <richardwbb@versatel.nl> - 2016-11-22 19:20 +0100
        Re: vulnerability in 8.6 Riku Valli <riku.valli@vallit.fi> - 2016-11-22 20:30 +0100

Page 1 of 2  [1] 2  Next page →

#5075 — vulnerability in 8.6

[Multipart message — attachments visible in raw view] — view raw

Hi all,

I have been reading security articles and I seen a test with Debian Linux
vulnerability of kernel. I tested and given a successful exploit.

List a vuln:

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

My testing:

dirtycow.c (status: success)
cowroot.c (status: success)

For example, I have installed Debian and kernel version are as follow:

Linux 3.16.0-4-amd64 (Debian 8.6)

I created a "zoo" file with root privileges and locked a file:

# echo I'm a root > foo
# chmod 0404 foo
# ls -la foo
-r-----r-- 1 root root 11 Nov  7 10:13 foo

then I'm return my user (not root) and I downloaded the exploit script and
run it:

$ gcc -pthread dirtyc0w.c -o dirtyc0w
$ ./dirtyc0w foo blabla
$ cat foo
blabla

what is the suggestion on this exploit?

Regards,

~Ozgur

[toc] | [next] | [standalone]

#5076

[Multipart message — attachments visible in raw view] — view raw

On 7 Nov 2016, at 16:54, Ozgur <okaratas@member.fsf.org> wrote:
> 
> Linux 3.16.0-4-amd64 (Debian 8.6)
> 

Always test security vulnerabilities on a fully patched system. According to https://security-tracker.debian.org/tracker/CVE-2016-5195 this was fixed in version 3.16.36-1+deb2 of the linux package. 

 Kind regards,

Richard

[toc] | [prev] | [next] | [standalone]

#5077

Hi,

On Mon, Nov 07, 2016 at 06:54:55PM +0300, Ozgur wrote:
> Hi all,
> 
> I have been reading security articles and I seen a test with Debian Linux
> vulnerability of kernel. I tested and given a successful exploit.
> 
> List a vuln:
> 
> https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
> 
> My testing:
> 
> dirtycow.c (status: success)
> cowroot.c (status: success)
> 
> For example, I have installed Debian and kernel version are as follow:
> 
> Linux 3.16.0-4-amd64 (Debian 8.6)
> 
> I created a "zoo" file with root privileges and locked a file:
> 
> # echo I'm a root > foo
> # chmod 0404 foo
> # ls -la foo
> -r-----r-- 1 root root 11 Nov  7 10:13 foo
> 
> then I'm return my user (not root) and I downloaded the exploit script and
> run it:
> 
> $ gcc -pthread dirtyc0w.c -o dirtyc0w
> $ ./dirtyc0w foo blabla
> $ cat foo
> blabla
> 
> what is the suggestion on this exploit?

Have you installed the Kernel update as per the security advisory
DSA-3696-1? Which kernel image do you have installed, which kernel is
running?

 [0] https://www.debian.org/security/2016/dsa-3696

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#5078

[Multipart message — attachments visible in raw view] — view raw

Hello Salvatore,

I updated the Debian system and again exploit it successful.

$ sudo apt-get update
$ sudo apt-get upgrade
$ sudo apt-get dist-upgrade

$ cat /etc/debian_version
8.6
$ uname -ar
Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64
GNU/Linux

Test:

$ ./dirtyc0w /etc/resolv.conf blabla (not root, normal user)
mmap 7faddc3f2000
madvise 0

procselfmem 600000000

$ cat /etc/resolv.conf
blabla8.8.8.8

Do I have to reinstall new Debian's?

~$ cat /etc/apt/sources.list

deb http://security.debian.org/ jessie/updates main contrib
deb-src http://security.debian.org/ jessie/updates main contrib

deb http://ftp.debian.org/debian/ jessie-updates main contrib
deb-src http://ftp.debian.org/debian/ jessie-updates main contrib

deb http://ftp.debian.org/debian/ jessie main contrib
deb-src http://ftp.debian.org/debian/ jessie main contrib

Regards,

~ Ozgur


2016-11-07 19:09 GMT+03:00 Salvatore Bonaccorso <carnil@debian.org>:

> Hi,
>
> On Mon, Nov 07, 2016 at 06:54:55PM +0300, Ozgur wrote:
> > Hi all,
> >
> > I have been reading security articles and I seen a test with Debian Linux
> > vulnerability of kernel. I tested and given a successful exploit.
> >
> > List a vuln:
> >
> > https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
> >
> > My testing:
> >
> > dirtycow.c (status: success)
> > cowroot.c (status: success)
> >
> > For example, I have installed Debian and kernel version are as follow:
> >
> > Linux 3.16.0-4-amd64 (Debian 8.6)
> >
> > I created a "zoo" file with root privileges and locked a file:
> >
> > # echo I'm a root > foo
> > # chmod 0404 foo
> > # ls -la foo
> > -r-----r-- 1 root root 11 Nov  7 10:13 foo
> >
> > then I'm return my user (not root) and I downloaded the exploit script
> and
> > run it:
> >
> > $ gcc -pthread dirtyc0w.c -o dirtyc0w
> > $ ./dirtyc0w foo blabla
> > $ cat foo
> > blabla
> >
> > what is the suggestion on this exploit?
>
> Have you installed the Kernel update as per the security advisory
> DSA-3696-1? Which kernel image do you have installed, which kernel is
> running?
>
>  [0] https://www.debian.org/security/2016/dsa-3696
>
> Regards,
> Salvatore
>



-- 
Ozgur

[toc] | [prev] | [next] | [standalone]

#5079

[Multipart message — attachments visible in raw view] — view raw

On 11/07/2016 09:45 AM, Ozgur wrote:

> $ uname -ar
> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03)
> x86_64 GNU/Linux

The update/upgrade didn't grab the latest security update for the
kernel. The version with the fix for CVE-2016-5195 (Dirty Cow) is
3.16.36-1+deb8u2

-- 
Nicholas Luedtke
HPE Linux Security, Hewlett-Packard Enterprise

[toc] | [prev] | [next] | [standalone]

#5081

[Multipart message — attachments visible in raw view] — view raw

Hello,

I think, I'm doing to wrong. My Debian system sources.list file as follow
and I don't seen linux image "3.16.36-1+deb8u2"
Thanks for all help,

Regards,

~ Ozgur

$ sudo cat /etc/apt/sources.list

deb http://security.debian.org/ jessie/updates main contrib
deb-src http://security.debian.org/ jessie/updates main contrib

deb http://ftp.debian.org/debian/ jessie-updates main contrib
deb-src http://ftp.debian.org/debian/ jessie-updates main contrib

deb http://ftp.debian.org/debian/ jessie main contrib
deb-src http://ftp.debian.org/debian/ jessie main contrib

$ sudo apt-cache search linux-image
linux-headers-3.16.0-4-amd64 - Header files for Linux 3.16.0-4-amd64
linux-image-3.16.0-4-amd64 - Linux 3.16 for 64-bit PCs
linux-image-3.16.0-4-amd64-dbg - Debugging symbols for Linux 3.16.0-4-amd64
linux-image-amd64 - Linux for 64-bit PCs (meta-package)
linux-image-amd64-dbg - Debugging symbols for Linux amd64 configuration
(meta-package)


2016-11-07 19:52 GMT+03:00 Nicholas Luedtke <nicholas.luedtke@hpe.com>:

> On 11/07/2016 09:45 AM, Ozgur wrote:
>
> $ uname -ar
> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64
> GNU/Linux
>
>
> The update/upgrade didn't grab the latest security update for the kernel.
> The version with the fix for CVE-2016-5195 (Dirty Cow) is 3.16.36-1+deb8u2
>
> --
> Nicholas Luedtke
> HPE Linux Security, Hewlett-Packard Enterprise
>
>

[toc] | [prev] | [next] | [standalone]

#5082

> $ sudo apt-cache search linux-image
> linux-headers-3.16.0-4-amd64 - Header files for Linux 3.16.0-4-amd64
> linux-image-3.16.0-4-amd64 - Linux 3.16 for 64-bit PCs
> linux-image-3.16.0-4-amd64-dbg - Debugging symbols for Linux 3.16.0-4-amd64
> linux-image-amd64 - Linux for 64-bit PCs (meta-package)
> linux-image-amd64-dbg - Debugging symbols for Linux amd64 configuration
> (meta-package)
> 

better try this command.

apt-cache policy linux-image-3.16.0-4-amd64
https://www.debian.org/doc/manuals/debian-handbook/sect.apt-cache.el.html

[toc] | [prev] | [next] | [standalone]

#5084

[Multipart message — attachments visible in raw view] — view raw

Also hopefully obvious, but since this is a kernel update it probably
wouldn't take effect until after a reboot, anyway. So, testing before
rebooting is silly.

On Nov 7, 2016 9:01 AM, "Ozgur" <okaratas@member.fsf.org> wrote:

Hello,

I think, I'm doing to wrong. My Debian system sources.list file as follow
and I don't seen linux image "3.16.36-1+deb8u2"
Thanks for all help,

Regards,

~ Ozgur

$ sudo cat /etc/apt/sources.list

deb http://security.debian.org/ jessie/updates main contrib
deb-src http://security.debian.org/ jessie/updates main contrib

deb http://ftp.debian.org/debian/ jessie-updates main contrib
deb-src http://ftp.debian.org/debian/ jessie-updates main contrib

deb http://ftp.debian.org/debian/ jessie main contrib
deb-src http://ftp.debian.org/debian/ jessie main contrib

$ sudo apt-cache search linux-image
linux-headers-3.16.0-4-amd64 - Header files for Linux 3.16.0-4-amd64
linux-image-3.16.0-4-amd64 - Linux 3.16 for 64-bit PCs
linux-image-3.16.0-4-amd64-dbg - Debugging symbols for Linux 3.16.0-4-amd64
linux-image-amd64 - Linux for 64-bit PCs (meta-package)
linux-image-amd64-dbg - Debugging symbols for Linux amd64 configuration
(meta-package)


2016-11-07 19:52 GMT+03:00 Nicholas Luedtke <nicholas.luedtke@hpe.com>:

> On 11/07/2016 09:45 AM, Ozgur wrote:
>
> $ uname -ar
> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64
> GNU/Linux
>
>
> The update/upgrade didn't grab the latest security update for the kernel.
> The version with the fix for CVE-2016-5195 (Dirty Cow) is 3.16.36-1+deb8u2
>
> --
> Nicholas Luedtke
> HPE Linux Security, Hewlett-Packard Enterprise
>
>

[toc] | [prev] | [next] | [standalone]

#5080

Hi 
maybe when you do the upgrade 
keeps back the linux-image* package.

the one it fix this vulnerability is:

linux-image-3.16.0-4-amd64     3.16.36-1+deb8u2            amd64        Linux 3.16 for 64-bit PCs
Linux mail 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19) x86_64 GNU/Linux


-- 

Matias Mucciolo

Area de Infraestructura.
Piedras 737 C.A.B.A 
SUTEBA 

On Monday 07 November 2016 19:45:57 Ozgur wrote:
> Hello Salvatore,
> 
> I updated the Debian system and again exploit it successful.
> 
> $ sudo apt-get update
> $ sudo apt-get upgrade
> $ sudo apt-get dist-upgrade
> 
> $ cat /etc/debian_version
> 8.6
> $ uname -ar
> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64
> GNU/Linux
> 
> Test:
> 
> $ ./dirtyc0w /etc/resolv.conf blabla (not root, normal user)
> mmap 7faddc3f2000
> madvise 0
> 
> procselfmem 600000000
> 
> $ cat /etc/resolv.conf
> blabla8.8.8.8
> 
> Do I have to reinstall new Debian's?
> 
> ~$ cat /etc/apt/sources.list
> 
> deb http://security.debian.org/ jessie/updates main contrib
> deb-src http://security.debian.org/ jessie/updates main contrib
> 
> deb http://ftp.debian.org/debian/ jessie-updates main contrib
> deb-src http://ftp.debian.org/debian/ jessie-updates main contrib
> 
> deb http://ftp.debian.org/debian/ jessie main contrib
> deb-src http://ftp.debian.org/debian/ jessie main contrib
> 
> Regards,
> 
> ~ Ozgur
> 
> 
> 2016-11-07 19:09 GMT+03:00 Salvatore Bonaccorso <carnil@debian.org>:
> 
> > Hi,
> >
> > On Mon, Nov 07, 2016 at 06:54:55PM +0300, Ozgur wrote:
> > > Hi all,
> > >
> > > I have been reading security articles and I seen a test with Debian Linux
> > > vulnerability of kernel. I tested and given a successful exploit.
> > >
> > > List a vuln:
> > >
> > > https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
> > >
> > > My testing:
> > >
> > > dirtycow.c (status: success)
> > > cowroot.c (status: success)
> > >
> > > For example, I have installed Debian and kernel version are as follow:
> > >
> > > Linux 3.16.0-4-amd64 (Debian 8.6)
> > >
> > > I created a "zoo" file with root privileges and locked a file:
> > >
> > > # echo I'm a root > foo
> > > # chmod 0404 foo
> > > # ls -la foo
> > > -r-----r-- 1 root root 11 Nov  7 10:13 foo
> > >
> > > then I'm return my user (not root) and I downloaded the exploit script
> > and
> > > run it:
> > >
> > > $ gcc -pthread dirtyc0w.c -o dirtyc0w
> > > $ ./dirtyc0w foo blabla
> > > $ cat foo
> > > blabla
> > >
> > > what is the suggestion on this exploit?
> >
> > Have you installed the Kernel update as per the security advisory
> > DSA-3696-1? Which kernel image do you have installed, which kernel is
> > running?
> >
> >  [0] https://www.debian.org/security/2016/dsa-3696
> >
> > Regards,
> > Salvatore
> >
> 
> 
> 
> -- 
> Ozgur

[toc] | [prev] | [next] | [standalone]

#5083

On Seg, 07 Nov 2016, Ozgur wrote:
> I updated the Debian system and again exploit it successful.

No, you didn't. (Well, kinda)

> $ uname -ar
> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64
> GNU/Linux

That's not the latest version, and specifically is not the one in  
which that vulnerability was fixed. You should have version  
3.16.36-1+deb8u2 .

> ~$ cat /etc/apt/sources.list
>
> deb http://security.debian.org/ jessie/updates main contrib
> deb-src http://security.debian.org/ jessie/updates main contrib
>
> deb http://ftp.debian.org/debian/ jessie-updates main contrib
> deb-src http://ftp.debian.org/debian/ jessie-updates main contrib
>
> deb http://ftp.debian.org/debian/ jessie main contrib
> deb-src http://ftp.debian.org/debian/ jessie main contrib

Your sources seem correct, though. What does "apt-cache policy  
linux-image-3.16.0-4-amd64" says?

-- 
Eduardo M KALINOWSKI
eduardo@kalinowski.com.br

[toc] | [prev] | [next] | [standalone]

#5085

Can we confirm whether or not the kernel is already installed? Is the 
newest version in the kernel in /boot? It's unclear from what's been 
said if the system has even been rebooted into the updated kernel.


On 11/07/2016 08:55 AM, Eduardo M KALINOWSKI wrote:
> On Seg, 07 Nov 2016, Ozgur wrote:
>> I updated the Debian system and again exploit it successful.
>
> No, you didn't. (Well, kinda)
>
>> $ uname -ar
>> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) 
>> x86_64
>> GNU/Linux
>
> That's not the latest version, and specifically is not the one in 
> which that vulnerability was fixed. You should have version 
> 3.16.36-1+deb8u2 .
>
>> ~$ cat /etc/apt/sources.list
>>
>> deb http://security.debian.org/ jessie/updates main contrib
>> deb-src http://security.debian.org/ jessie/updates main contrib
>>
>> deb http://ftp.debian.org/debian/ jessie-updates main contrib
>> deb-src http://ftp.debian.org/debian/ jessie-updates main contrib
>>
>> deb http://ftp.debian.org/debian/ jessie main contrib
>> deb-src http://ftp.debian.org/debian/ jessie main contrib
>
> Your sources seem correct, though. What does "apt-cache policy 
> linux-image-3.16.0-4-amd64" says?
>

[toc] | [prev] | [next] | [standalone]

#5086

[Multipart message — attachments visible in raw view] — view raw

Hello Mike;

thanks for all help and I checked /boot

$ ls /boot/
config-3.16.0-4-amd64  grub  initrd.img-3.16.0-4-amd64
 System.map-3.16.0-4-amd64  vmlinuz-3.16.0-4-amd64

$ sudo update-grub
[sudo] password for x:
Generating grub configuration file ...
Found background image: /usr/share/images/desktop-base/desktop-grub.png
Found linux image: /boot/vmlinuz-3.16.0-4-amd64
Found initrd image: /boot/initrd.img-3.16.0-4-amd64
done


So, I'm shared below apt policy:

$ apt-cache policy linux-image-3.16.0-4-amd64
linux-image-3.16.0-4-amd64:
  Installed: 3.16.36-1+deb8u2
  Candidate: 3.16.36-1+deb8u2
  Version table:
 *** 3.16.36-1+deb8u2 0
        500 http://security.debian.org/ jessie/updates/main amd64 Packages
        100 /var/lib/dpkg/status
     3.16.36-1+deb8u1 0
        500 http://ftp.debian.org/debian/ jessie/main amd64 Packages
     3.16.7-ckt25-2 0
        500 http://ftp.debian.org/debian/ jessie-updates/main amd64 Packages


Regards,

Ozgur


2016-11-07 20:18 GMT+03:00 Mike Oliver <mike@mopmeat.net>:

> Can we confirm whether or not the kernel is already installed? Is the
> newest version in the kernel in /boot? It's unclear from what's been said
> if the system has even been rebooted into the updated kernel.
>
>
>
> On 11/07/2016 08:55 AM, Eduardo M KALINOWSKI wrote:
>
>> On Seg, 07 Nov 2016, Ozgur wrote:
>>
>>> I updated the Debian system and again exploit it successful.
>>>
>>
>> No, you didn't. (Well, kinda)
>>
>> $ uname -ar
>>> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u1 (2016-09-03) x86_64
>>> GNU/Linux
>>>
>>
>> That's not the latest version, and specifically is not the one in which
>> that vulnerability was fixed. You should have version 3.16.36-1+deb8u2 .
>>
>> ~$ cat /etc/apt/sources.list
>>>
>>> deb http://security.debian.org/ jessie/updates main contrib
>>> deb-src http://security.debian.org/ jessie/updates main contrib
>>>
>>> deb http://ftp.debian.org/debian/ jessie-updates main contrib
>>> deb-src http://ftp.debian.org/debian/ jessie-updates main contrib
>>>
>>> deb http://ftp.debian.org/debian/ jessie main contrib
>>> deb-src http://ftp.debian.org/debian/ jessie main contrib
>>>
>>
>> Your sources seem correct, though. What does "apt-cache policy
>> linux-image-3.16.0-4-amd64" says?
>>
>>
>


-- 
Ozgur

[toc] | [prev] | [next] | [standalone]

#5087

Please reply to the list, not directly to me.

On 07-11-2016 16:49, Ozgur wrote:
> Hello Eduardo;
>
>
> $ uname -ar
> Linux x 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19)
> x86_64 GNU/Linux
>
> $ apt-cache policy linux-image-3.16.0-4-amd64
> linux-image-3.16.0-4-amd64:
>   Installed: 3.16.36-1+deb8u2
>   Candidate: 3.16.36-1+deb8u2
>   Version table:
>  *** 3.16.36-1+deb8u2 0
>         500 http://security.debian.org/ jessie/updates/main amd64 Packages
>         100 /var/lib/dpkg/status
>      3.16.36-1+deb8u1 0
>         500 http://ftp.debian.org/debian/ jessie/main amd64 Packages
>      3.16.7-ckt25-2 0
>         500 http://ftp.debian.org/debian/ jessie-updates/main amd64
> Packages
>

Now you're running the latest version. You might have been missing a
reboot, as someone else pointed.


-- 
Q:	Why should you always serve a Southern Carolina football man
	soup in a plate?
A:	'Cause if you give him a bowl, he'll throw it away.

Eduardo M KALINOWSKI
eduardo@kalinowski.com.br

[toc] | [prev] | [next] | [standalone]

#5104

Hi Salvatore, Ozgur,

You posted this url; https://www.debian.org/security/2016/dsa-3696

I've been looking in to this exploit, and did what Ozgur found on
Github, and I learned that my system is vulnerable. I had a difference,
which is that dirtyc0w, did overwrite the read-only 'foo' file, but it
hang, and it also did write up to the length of the original content of
that file. So my 'foo' was six bytes long and I attempted to overwrite
with a longer sequence, and it stopped. After seeing this had happened,
I started over with a new 'foo' file, and this time I attempted a
shorter byte sequence and it also hang. From what I've read, it doesn't
seem to hang. 

I'm guessing that overwriting the sudoers file for example would make
the exploiter a rooted user on the exploited system..

But, I have looked for a update and I went to Debian package search and
searched for; 'kernel image 686
pae' [https://packages.debian.org/search?suite=stable&section=all&arch=any&searchon=names&keywords=kernel+image+686+pae]

This gave one result, which is; 'kernel-image-3.16.0-4-686-pae-di' and
written with that, 'Linux kernel binary image for the Debian installer
3.16.36-1+deb8u1: i386'

And I read that I need a '+deb8u2' kernel?

Can someone explain to me what to do next? I have the assumption that a
'apt-get install "name-of-required-kerne-package"' would be sufficient?

If not, can someone point me in the right direction on what to do,
because the link Salvatore posted, it says on that page; 

'For the stable distribution (jessie), these problems have been fixed in
version 3.16.36-1+deb8u2.

We recommend that you upgrade your linux packages.'

-- 
Richard Waterbeek <richardwbb@versatel.nl>



Salvatore Bonaccorso schreef op ma 07-11-2016 om 17:09 [+0100]:
> Hi,
> 
> On Mon, Nov 07, 2016 at 06:54:55PM +0300, Ozgur wrote:
> > Hi all,
> > 
> > I have been reading security articles and I seen a test with Debian Linux
> > vulnerability of kernel. I tested and given a successful exploit.
> > 
> > List a vuln:
> > 
> > https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
> > 
> > My testing:
> > 
> > dirtycow.c (status: success)
> > cowroot.c (status: success)
> > 
> > For example, I have installed Debian and kernel version are as follow:
> > 
> > Linux 3.16.0-4-amd64 (Debian 8.6)
> > 
> > I created a "zoo" file with root privileges and locked a file:
> > 
> > # echo I'm a root > foo
> > # chmod 0404 foo
> > # ls -la foo
> > -r-----r-- 1 root root 11 Nov  7 10:13 foo
> > 
> > then I'm return my user (not root) and I downloaded the exploit script and
> > run it:
> > 
> > $ gcc -pthread dirtyc0w.c -o dirtyc0w
> > $ ./dirtyc0w foo blabla
> > $ cat foo
> > blabla
> > 
> > what is the suggestion on this exploit?
> 
> Have you installed the Kernel update as per the security advisory
> DSA-3696-1? Which kernel image do you have installed, which kernel is
> running?
> 
>  [0] https://www.debian.org/security/2016/dsa-3696
> 
> Regards,
> Salvatore
> 

[toc] | [prev] | [next] | [standalone]

#5106

On 11/10/16 04:20, Richard Waterbeek wrote:
> Hi Salvatore, Ozgur,
> 
> You posted this url; https://www.debian.org/security/2016/dsa-3696
> 
> But, I have looked for a update and I went to Debian package search and
> searched for; 'kernel image 686
> pae' [https://packages.debian.org/search?suite=stable&section=all&arch=any&searchon=names&keywords=kernel+image+686+pae]
> 
> This gave one result, which is; 'kernel-image-3.16.0-4-686-pae-di' and
> written with that, 'Linux kernel binary image for the Debian installer
> 3.16.36-1+deb8u1: i386'

Check what kernel is your system running:

# uname -a
Linux hostname 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2
(2016-10-19) x86_64 GNU/Linux

The kernel packages for running system (not installer) are:
linux-image-*** not kernel-image-***

You can chek what is installed by: dpkg -l|grep linux

> And I read that I need a '+deb8u2' kernel?
> 
> Can someone explain to me what to do next? I have the assumption that a
> 'apt-get install "name-of-required-kerne-package"' would be sufficient?

apt-get update; apt-get upgrade

followed by reboot should be sufficient.

-- 
Best Regards
        Vladislav Kurz

[toc] | [prev] | [next] | [standalone]

#5114

Hi,

I wrote that I searched for a '686' image but that was meant for this
VirtualBox I have, my 64Bit processor only can emulate 32Bit.

uname -ar gave; Linux <hostname> 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1
+deb8u1 (2016-09-03) x86_64 GNU/Linux

dpkg -l | grep linux-image gave; linux-image-3.16.0-4-amd64
3.16.36-1+deb8u1

I ran; sudo apt-get update, followed by sudo apt-get upgrade and that
gave;

The following packages will be upgraded:
  tzdata tzdata-java
2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 268 kB of archives.
After this operation, 16.4 kB of additional disk space will be used.

This seems a little unexpected to me. A real long time ago I update just
the kernel once on a Slackware machine and finished that with;
update-grub.

I thought a sudo apt-get install linux-image-3.16.0-4-amd64 followed by
update-grub is sufficient to upgrade the kernel. 

So I did; sudo apt-get install, preceded by sudo apt-get upgrade and
that gave;

linux-image-3.16.0-4-amd64 is already the newest version.

And just now it is clear to me that something must be wrong, so thank
you for helping enabling me to clarify my questions.

Hoping to hear from you what to do now.

-- 
Richard Waterbeek <richardwbb@versatel.nl>



Vladislav Kurz schreef op do 10-11-2016 om 10:28 [+0100]:
> On 11/10/16 04:20, Richard Waterbeek wrote:
> > Hi Salvatore, Ozgur,
> > 
> > You posted this url; https://www.debian.org/security/2016/dsa-3696
> > 
> > But, I have looked for a update and I went to Debian package search and
> > searched for; 'kernel image 686
> > pae' [https://packages.debian.org/search?suite=stable&section=all&arch=any&searchon=names&keywords=kernel+image+686+pae]
> > 
> > This gave one result, which is; 'kernel-image-3.16.0-4-686-pae-di' and
> > written with that, 'Linux kernel binary image for the Debian installer
> > 3.16.36-1+deb8u1: i386'
> 
> Check what kernel is your system running:
> 
> # uname -a
> Linux hostname 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2
> (2016-10-19) x86_64 GNU/Linux
> 
> The kernel packages for running system (not installer) are:
> linux-image-*** not kernel-image-***
> 
> You can chek what is installed by: dpkg -l|grep linux
> 
> > And I read that I need a '+deb8u2' kernel?
> > 
> > Can someone explain to me what to do next? I have the assumption that a
> > 'apt-get install "name-of-required-kerne-package"' would be sufficient?
> 
> apt-get update; apt-get upgrade
> 
> followed by reboot should be sufficient.
> 

[toc] | [prev] | [next] | [standalone]

#5115

Hi Richard,

On Wed, Nov 16, 2016 at 09:25:11PM +0100, Richard Waterbeek wrote:
> Hi,
> 
> I wrote that I searched for a '686' image but that was meant for this
> VirtualBox I have, my 64Bit processor only can emulate 32Bit.
> 
> uname -ar gave; Linux <hostname> 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1
> +deb8u1 (2016-09-03) x86_64 GNU/Linux
> 
> dpkg -l | grep linux-image gave; linux-image-3.16.0-4-amd64
> 3.16.36-1+deb8u1
> 
> I ran; sudo apt-get update, followed by sudo apt-get upgrade and that
> gave;
> 
> The following packages will be upgraded:
>   tzdata tzdata-java
> 2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
> Need to get 268 kB of archives.
> After this operation, 16.4 kB of additional disk space will be used.
> 
> This seems a little unexpected to me. A real long time ago I update just
> the kernel once on a Slackware machine and finished that with;
> update-grub.
> 
> I thought a sudo apt-get install linux-image-3.16.0-4-amd64 followed by
> update-grub is sufficient to upgrade the kernel. 
> 
> So I did; sudo apt-get install, preceded by sudo apt-get upgrade and
> that gave;
> 
> linux-image-3.16.0-4-amd64 is already the newest version.
> 
> And just now it is clear to me that something must be wrong, so thank
> you for helping enabling me to clarify my questions.
> 
> Hoping to hear from you what to do now.

Could you check that you have the security archive in your
sources.list? 

Cf. https://www.debian.org/security/#keeping-secure

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#5107

El 10/11/16 a las 04:20, Richard Waterbeek escribió:
> [---snap---]
> But, I have looked for a update and I went to Debian package search and
> searched for; 'kernel image 686
> pae' [https://packages.debian.org/search?suite=stable&section=all&arch=any&searchon=names&keywords=kernel+image+686+pae]
>
> This gave one result, which is; 'kernel-image-3.16.0-4-686-pae-di' and
> written with that, 'Linux kernel binary image for the Debian installer
> 3.16.36-1+deb8u1: i386'
>
> And I read that I need a '+deb8u2' kernel?
>
> Can someone explain to me what to do next? I have the assumption that a
> 'apt-get install "name-of-required-kerne-package"' would be sufficient?
>
> If not, can someone point me in the right direction on what to do,
> because the link Salvatore posted, it says on that page;
>
> 'For the stable distribution (jessie), these problems have been fixed in
> version 3.16.36-1+deb8u2.
>
> We recommend that you upgrade your linux packages.'
>

Hi Richard, on the one hand if your package manager is configured 
properly, it should handle this situation without trouble.

Remember to run "update" to refresh the list of packages available 
before "upgrade".

On the other hand, if you're going to do a manual search you've to look 
for "linux image" not "kernel image" because the latter is for use in 
building debian-installer images only.

Regards.

--
advocatux

[toc] | [prev] | [next] | [standalone]

#5109

[Multipart message — attachments visible in raw view] — view raw

hello:

this package is in security repo:  "http://security.debian.org
jessie/updates main contrib"

apt-cache showpkg linux-image-3.16.0-4-amd64
Package: linux-image-3.16.0-4-amd64
Versions:
3.16.36-1+deb8u2
(/var/lib/apt/lists/security.debian.org_dists_jessie_updates_main_binary-amd64_Packages)
(/var/lib/apt/lists/apt-mirr
or.slyt.gba.gov.ar_debian-security_dists_jessie_updates_main_binary-amd64_Packages)




El jue., 10 de nov. de 2016 a la(s) 06:46, advocatux <advocatux@gmail.com>
escribió:

>
> El 10/11/16 a las 04:20, Richard Waterbeek escribió:
> > [---snap---]
> > But, I have looked for a update and I went to Debian package search and
> > searched for; 'kernel image 686
> > pae' [
> https://packages.debian.org/search?suite=stable&section=all&arch=any&searchon=names&keywords=kernel+image+686+pae
> ]
> >
> > This gave one result, which is; 'kernel-image-3.16.0-4-686-pae-di' and
> > written with that, 'Linux kernel binary image for the Debian installer
> > 3.16.36-1+deb8u1: i386'
> >
> > And I read that I need a '+deb8u2' kernel?
> >
> > Can someone explain to me what to do next? I have the assumption that a
> > 'apt-get install "name-of-required-kerne-package"' would be sufficient?
> >
> > If not, can someone point me in the right direction on what to do,
> > because the link Salvatore posted, it says on that page;
> >
> > 'For the stable distribution (jessie), these problems have been fixed in
> > version 3.16.36-1+deb8u2.
> >
> > We recommend that you upgrade your linux packages.'
> >
>
> Hi Richard, on the one hand if your package manager is configured
> properly, it should handle this situation without trouble.
>
> Remember to run "update" to refresh the list of packages available
> before "upgrade".
>
> On the other hand, if you're going to do a manual search you've to look
> for "linux image" not "kernel image" because the latter is for use in
> building debian-installer images only.
>
> Regards.
>
> --
> advocatux
>
> --

*|    Heavy voodoo here.  I can't even believe you are reading this.
|    Are you crazy?  Don't even think about adjusting these unless
|    you understand the algorithms in comm_select.c first!*

*every error lies a great risk*

[toc] | [prev] | [next] | [standalone]

#5118

Hello again,

I managed to re-install with the updated kernel image [linux-image].

Why I didn't receive the sought for updated kernel with 'sudo apt-get
update', remains unclear to me.

I've downloaded the .deb package from
'https://packages.debian.org/jessie/linux-image-3.16.0-4-amd64',
followed by dpkg -i <package name>.

The 'update-grub' command was automatically ran after this, and the
reboot showed nothing related, it all went well.

Thank you for pointing me in the right direction.

Richard

-- 
Richard Waterbeek <richardwbb@versatel.nl>


Salvatore Bonaccorso schreef op ma 07-11-2016 om 17:09 [+0100]:
> Hi,
> 
> On Mon, Nov 07, 2016 at 06:54:55PM +0300, Ozgur wrote:
> > Hi all,
> > 
> > I have been reading security articles and I seen a test with Debian Linux
> > vulnerability of kernel. I tested and given a successful exploit.
> > 
> > List a vuln:
> > 
> > https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs
> > 
> > My testing:
> > 
> > dirtycow.c (status: success)
> > cowroot.c (status: success)
> > 
> > For example, I have installed Debian and kernel version are as follow:
> > 
> > Linux 3.16.0-4-amd64 (Debian 8.6)
> > 
> > I created a "zoo" file with root privileges and locked a file:
> > 
> > # echo I'm a root > foo
> > # chmod 0404 foo
> > # ls -la foo
> > -r-----r-- 1 root root 11 Nov  7 10:13 foo
> > 
> > then I'm return my user (not root) and I downloaded the exploit script and
> > run it:
> > 
> > $ gcc -pthread dirtyc0w.c -o dirtyc0w
> > $ ./dirtyc0w foo blabla
> > $ cat foo
> > blabla
> > 
> > what is the suggestion on this exploit?
> 
> Have you installed the Kernel update as per the security advisory
> DSA-3696-1? Which kernel image do you have installed, which kernel is
> running?
> 
>  [0] https://www.debian.org/security/2016/dsa-3696
> 
> Regards,
> Salvatore

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.security

csiph-web