Linux kernel root-level exploit leveraging three previous vulnerabilities

Did not work on a server running Debian Lenny with 2.6.26-2-amd64. Worked fine on Ubuntu Server 10.10 with 2.6.35-22-generic-pae though (got root shell).

The comments mention that the exploit for CVE-2010-3850 is limited in regard to Slackware, Debian and Red Hat "in the interest of public safety". Interesting.

Note to everyone here: the interesting issue is CVE-2010-4258 (write a NULL to arbitrary memory on OOPS). The other two issues have been deliberately chosen to be exotic and hard to exploit, but

    * However, the important issue, CVE-2010-4258, affects everyone, and it would
    * be trivial to find an unpatched DoS under KERNEL_DS and write a slightly
    * more sophisticated version of this that doesn't have the roadblocks I put in
    * to prevent abuse by script kiddies.

So no, if this happened not to work on your box, you'll still want to upgrade.

[EDIT: this was also pointed out by bdonlan, http://news.ycombinator.com/item?id=1981738]

Information on kernel OOPS for others who were not familiar with the term. http://en.wikipedia.org/wiki/Linux_kernel_oops

Exploit didn't work on my Ubuntu 10.04.1 LTS. It does say the exploits are fixed on Ubuntu, but the socket(PF_ECONET,...) call not working stopped it on my box.

This didn't work on an Arch linux (x86) box. I think I did pacman -Syu last weekend, so it's reasonably up to date.

It also doesn't work on my Slackware server, which has a pretty heavily modified 2.6.23.14 kernel.

In the context of the other comments, does this mean that a lack of a software monoculture keeps these sorts of exploits from damaging the entire population of linux machines?

Any countermeasures, besides not using a kernel supporting the Econet protocol? I.e., does there exist a fix for the first CVE addressed in the exploit's comment?

Worked on Ubuntu 10.10 Meerkat. Gotta love it. Instant root.

Failed on mine

    tzury@precision:/tmp$ uname -a
    Linux precision 2.6.32-26-generic #48-Ubuntu SMP Wed Nov 24 10:14:11 UTC 2010 x86_64 GNU/Linux
    tzury@precision:/tmp$ gcc nelson.c 
    tzury@precision:/tmp$ ./a.out 
     [*] Resolving kernel addresses...
     [+] Resolved econet_ioctl to 0xffffffffa00705d0
     [+] Resolved econet_ops to 0xffffffffa00706c0
     [+] Resolved commit_creds to 0xffffffff8108aed0
     [+] Resolved prepare_kernel_cred to 0xffffffff8108b2b0
    [*] Calculating target...
    [*] Triggering payload...
    [*] Exploit failed to get root.