Hacker News Reader

Comment by tshtf | Hacker News Reader

The blog post specifically thanks the Red Hat Security Team, but according to the Red Hat Bugzilla, no patch has been released yet for RHEL/CentOS:

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7 and will be addressed in a future update.

https://bugzilla.redhat.com/show_bug.cgi?id=1297475

Premature blog post?

View on HN

Given that it looks like commits were just made 12 days ago (https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....) or possibly as recently as 38 hours ago (https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux....), perhaps only 4.4 has the fix?

Tested on CentOS 7, fully patched.

    [ohadmin@localhost shm]$ ./cve_2016_0728 PP_KEY
    uid=99990, euid=99990
    Increfing...

This is taking a long time. I disabled SELinux and it has been cranking away for a while now.

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
    1140 ohadmin   20   0    8428    388    296 R 100.0  0.0   9:25.17 cve_2016_0728

No need to test on CentOS 6. Forgot how ancient that kernel is.

Update: I am not having any luck getting this to work on CentOS 7. I even completely disabled SELinux (selinux=0 vs setenforce 0) Anyone else getting this to work?

That's not how you execute binaries, just "./cve_2016_0728 PP_KEY" is the correct syntax

Yes sorry. I will make the cheap excuse that I am recovering from food poisoning and don't quite have it all together. Thankfully I don't manage nuclear weapons, so we are all safe for now.

You need to update the addresses of commit_creds() and prepare_kernel_cred() as per this: https://news.ycombinator.com/item?id=10931954

The best I can get is an oops panic on CentOS 7.

It appears smaps may be preventing the exploit from working.

Reply on news.ycombinator.com