Hacker News Reader

Comment by juhanima | Hacker News Reader

Arch seems to be kosher

  $ uname -r
  4.3.3-2-ARCH

No root:

  $ ./cve_2016_0728 PP_KEY
  uid=1000, euid=1000
  Increfing...
  finished increfing
  forking...
  finished forking
  caling revoke...
  uid=1000, euid=1000

Only took about 25 minutes on a Lenovo core i7. That's kind of scary.

EDIT: Actually it seems that atomic_t is 64 bits long with x86_64 these days, so no hope of overflowing.

View on HN

Arch is not kosher. You need to do this: https://news.ycombinator.com/item?id=10931954

I did. I still maintain that the reason why the exploit doesn't work is this:

include/asm-generic/atomic-long.h:

  #if BITS_PER_LONG == 64
  typedef atomic64_t atomic_long_t;
  ...
  #else
  typedef atomic_t atomic_long_t;

Just checking it with a 32-bit VM with the latest upstream kernel.

EDIT: No, I was wrong. atomic_t is 32 bits also with 64 bit architecture. Must be something else then, let's see.

Reply on news.ycombinator.com