Linux af_packet.c race condition local root exploit
seclists.org
seclists.org
Does anyone know where to find more advice like this? Which features of the kernel to disable in order to be more secure?
In fact, many of the KSP patches are inspired by Grsecurity.
Archlinux has packages that make it very easy to use.
Naturally you still benefit a ton without those, but the ideal situation involves compiling it.
"Non-privileged user namespaces disabled by default, only vulnerable with sysctl kernel.unprivileged_userns_clone=1"
But: ... on systems where unprivileged namespaces are enabled (Ubuntu, Fedora, etc).
Interesting that Ubuntu and Debian differ here.
As of right now it doesn't appear that any distribution has fixed this yet, which is odd since it was fixed upstream a week ago.
"Virtuozzo team uploads stable kernels for OpenVZ version 7, tested for our commercial customers, approximately once a quarter. In between, we do not test or release any kernels - all the intermediate updates are delivered to our commercial customers in rebootless (kpatch) format without building full kernel updates. Again, this is a part of our commercial offering.
As for the contributions to the community product, we still build these kernels for the "factory" repository. However, we are not equipped to test them on regular basis, between these quarterly updates."
The race in systrace was that non-scalar syscall arguments (e.g. file path strings) were not copied into kernel space before running the policy checks. That meant that a malicious process could alter a string argument (e.g. from another thread) after the systrace check but before the syscall routine actually used the argument. It was a well-known issue with systrace, but systrace worked well other than that. (And, arguably, even with the race it still provided a worthwhile mitigation as long as it was understood it wasn't bulletproof for non-scalar values.)
Copying non-scalar arguments into kernel buffers was considered too costly. I don't even think OpenBSD bothered doing it, and certainly Linux didn't as systrace was an out-of-tree patch. OpenBSD's pledge framework does have the ability to verify some string arguments (e.g. paths to open), which of course necessitates first copying them into kernel space. (Or, at least, for certain strings, such as "/etc/passwd", replacing the argument with an in-kernel address.)
Linux seccomp is very similar to systrace. Rather than addressing the race wrt non-scalar arguments, seccomp simply doesn't allow you to check the value of non-scalar arguments. So, for example, you cannot write a seccomp policy that can directly check the path argument to open.[1]
[1] You can, however, write a string to a mmap'd region, make the region read-only, load seccomp policies that prevent changing the flags of that region (e.g. a policy checking the address ranges of mmap, madvise, etc). Then when you use wish to pass a particular string value to a syscall that is whitelisted by a seccomp policy, you lookup the string in the protected region and pass a pointer to _that_ string if it exists. Then the seccomp policy can verify the _address_ of the string knowing that [theoretically] the object it points to is immutable. It's all very convoluted and brittle, though. And it also makes it difficult to emulate OpenBSD pledge on Linux.[2] You'd have to interpose the libc syscall wrappers to looking string arguments in the protected region.
[2] The other issue is that pledges aren't inherited across fork while seccomp policies are always inherited, which means you definitely cannot emulate pledge on Linux if you allow forking.
> On Android, processes with gid=3004/AID_NET_RAW are able to create AF_PACKET sockets (mediaserver) and can trigger the bug.
I believe that this is the Android permission android.permission.NET_ADMIN, so it should work in theory...
System apps can obviously do it - hence the "(mediaserver)" comment.