TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

The poisoned NUL byte, 2014 edition

231 点作者 tshtf超过 10 年前

6 条评论

deathanatos超过 10 年前
Can someone explain this a bit? While I can understand how these bugs arise, I&#x27;m not the best at exploiting them.<p>The summary states,<p>&gt; disclosed a glibc NUL byte off-by-one overwrite into the heap.<p>&gt; a full exploit (with comments) for a local Linux privilege escalation.<p>Normally, I wouldn&#x27;t see how such a bug could lead to privilege escalation. (glibc runs in userspace, after all.) But it is glibc, and glibc is everywhere.<p>I <i>think</i> the key is in the source code, where they state,<p><pre><code> &#x2F;&#x2F; It actually relies on a pkexec bug: a memory leak when multiple -u arguments are specified. </code></pre> pkexec is setuid, so if it has a bug, then it&#x27;s a great target for privilege escalation. Is the exploit the fact that they&#x27;re passing bogus arguments to pkexec in such a way as to trigger this bug, corrupt the heap, and cause pkexec to either execute a binary of their choice or execute arbitrary code?
评论 #8226093 未加载
tptacek超过 10 年前
This is one of the all-time great exploit writeups.
评论 #8225834 未加载
评论 #8228511 未加载
jfindley超过 10 年前
I was interested to learn that the kernel actually allows you to pass 15 <i>million</i> arguments via execve(), with each one allowed to be enormous.<p>It seems very much like asking for trouble - I can&#x27;t offhand think of a good reason why this would be required.<p>I&#x27;m sure there are plenty of programs that have similar memory leaks with commandline args, as many authors might, not unreasonably, think that abuse would be prevented by the shell ARG_MAX, which is 2621440 bytes on many systems. Perhaps some sort of adjustable lower limit might be appropriate here.
评论 #8227040 未加载
评论 #8226352 未加载
JonnieCache超过 10 年前
geohot hunts bugs for google now. I did not know that. Nice to see a happy ending there.
muppetman超过 10 年前
That&#x27;s very impressive. It&#x27;s also why you should be running a pax&#x2F;grsecurity enabled kernel.
评论 #8228594 未加载
crazypyro超过 10 年前
I just want to join the choir and thank the author&#x2F;poster. Really great article. I managed to learn quite a few things and there was just enough detail given to go and look up any background information necessary to complete understanding.