Some webpages embed resources from other domains. Because of the web browser's storied and sordid history, it's possible for those resources to carry invisible, ambient authority without their creators' knowledge. One concrete example is Cross-Site Request Forgery: the JavaScript on a particular webpage can make an XMLHttpRequest to a resource on another domain and the browser will (in some…
In December 2016 I wrote a piece about using Grsecurity to prevent new USB devices from being loaded. Grsecurity has, unfortunately, left this world , but the linux-hardened project has taken on some of the patches and updates. I thought it would be worth a minor update to that post now that linux-hardened has ported the deny_new_usb patches , and uses a marginally different sysctl setting. The…
Before Linux 4.6, the default value of /proc/sys/kernel/perf_event_paranoid was 1, and so any Linux process could sample kernel addresses with perf_event_open 's PERF_SAMPLE_IP . So you can break KASLR by sampling the addresses and taking the mininum. Listing 59: perf_rip_find.c /* -*- compile-command: "gcc -Wall perf_rip_find.c -o perf_rip_find" -*- */ #include <fcntl.h> #include <unistd.h>…
An update to this post using the linux-hardened project is available here . USB has some surprising security implications: when a device is plugged in, the operating system generally loads the appropriate driver and initializes it. For example, plugging a device into an unlocked computer can execute code, since the device can act as a USB keyboard. This is how the "BadUSB" series of attacks work.…
I read this document but had a little trouble understanding it at first: "Vulnerability: POINTYFEATHER aka Tar extract pathname bypass" : Tar will happily extract files & directories into an arbitrary location when supplied with a suitably crafted archive file. If a target system is extracting an attacker supplied file, the vulnerability can be exploited to gain file overwrite capability. So, some…
userfaultfd is being used in kernel exploits to temporarily stop kernel execution . I had trouble finding out how to use it, so I wrote a little program. Some notes: If you don't include O_NONBLOCK in the userfaultfd flags argument, poll will always return a POLLERR . The API is complicated by a backwards-compatibility mechanism. You're supposed to issue some ioctls and examine the struct to check…
I've used Linux containers directly and indirectly for years, but I wanted to become more familiar with them. So I wrote some code. This used to be 500 lines of code, I swear, but I've revised it some since publishing; I've ended up with about 70 lines more. I wanted specifically to find a minimal set of restrictions to run untrusted code. This isn't how you should approach containers on anything…
I saw this recently: Listing 55: CVE request: GNU Guile <= 2.0.12: REPL server GNU Guile, an implementation of the Scheme language, provides a “REPL server” which is a command prompt that developers can connect to for live coding and debugging purposes. The REPL server is started by the ‘--listen’ command-line option or equivalent API. Christopher Allan Webber reported that the REPL server is…
I saw this recently: Listing 57: CVE request: GNU Guile <= 2.0.12: REPL server GNU Guile, an implementation of the Scheme language, provides a “REPL server” which is a command prompt that developers can connect to for live coding and debugging purposes. The REPL server is started by the ‘--listen’ command-line option or equivalent API. Christopher Allan Webber reported that the REPL server is…