Linux 2.6.31 perf_counter 0day Local Root Exploit

Video dedicated to nemo, because I know he loves these!
Described in the changelog as causing a "kernel crash" -- this proves the claim to be a joke. I hacked it up into the enlightenment framework I wrote so it's automatically weaponized. Some of the informative information is left out since I need to iret to userland, and my framework currently doesn't have hooks to handle such cases. It's also x86 only right now because it's late and I have no time to test x64.

Category:

Comedy

Tags:

• linux
• root
• exploit
• 0day

[JoCaGoVi]

wait after you compile you where able to map zero page?! SELinux may be on but the policy is broken; Fedora 14 with Fedora's default SELinux policy won't allow this!

[spendergrsec]

@JoCaGoVi Uh, go look at the date this video was made, then go look at the date Fedora 14 came out. This is an old exploit. Would be quite ridiculous if it still worked 2 years later wouldn't it?

[yanaventer]

pills here

[spendergrsec]

grabbin pills!

[JoCaGoVi]

@spendergrsec Indeed, my bad! Tip of the hat for you Sir.

[hal970fx]

Was SELinux enabled or disabled?

Can this be reproduced with the current kernel?

[DaveTehDuud]

win

[benc3]

i love it :)

[lafounneur1]

nice jobs, I heard you use Windows Vista like prefered OS. Do you try to find all Administrator Exploit too? ;) I don't thinks, the number is too big...

[BlueOrchids2009]

mmm mmm 0day

[fhuyyilb]

what is that perf_counter ?

[hermenaut]

Awesome! I started looking into this, but you, sir, are an exploit-generating machine!