{"id":101712,"date":"2021-10-21T10:22:53","date_gmt":"2021-10-21T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux"},"modified":"2021-10-21T10:22:53","modified_gmt":"2021-10-21T08:22:53","slug":"raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/raskryta-tehnika-ekspluataczii-uyazvimosti-v-tty-podsisteme-yadra-linux","title":{"rendered":"Technique for exploiting a vulnerability in the Linux kernel's tty subsystem disclosed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from the Google Project Zero team have published an exploitation method for the vulnerability (CVE-2020-29661) in the ioctl handler implementation TIOCSPGRP from the tty subsystem of the Linux kernel and have detailed the protective mechanisms that could block such vulnerabilities. <\/p>\n
The problematic bug was fixed in the Linux kernel on December 3rd of last year. The issue affects kernels up to version 5.9.13, but most distributions have resolved the problem in kernel package updates proposed last year (Debian, RHEL, SUSE, Ubuntu, Fedora, Arch). A similar vulnerability (CVE-2020-29660) was simultaneously found in the implementation of the ioctl call TIOCGSID, but it has also been widely addressed. <\/p>\n
The problem is caused by a mistake in locking, leading to a race condition in the code drivers\/tty\/tty_jobctrl.c, which has been exploited to create a use-after-free condition accessible from user space through manipulations with the ioctl call TIOCSPGRP. A working exploit was demonstrated for privilege escalation on Debian 10 with kernel version 4.19.0-13-amd64. <\/p>\n
In the published article, the emphasis is not so much on the technique of creating a working exploit, but rather on the tools present in the kernel for protection against such vulnerabilities. The conclusion drawn is not hopeful; methods like heap memory segmentation and control over memory access after it has been freed are not implemented in practice as they lead to performance degradation, and CFI (Control Flow Integrity) based protection, which blocks exploits at later stages of an attack, requires further refinement. <\/p>\n
In considering what could change the situation in the long term, advanced static analyzers or the use of languages that provide safe memory handling, such as Rust and dialects of C with enhanced annotations (e.g., Checked C), are highlighted. Additionally, protection methods include activating the panic_on_oops mode, converting kernel structures to read-only mode, and restricting access to system calls using mechanisms such as seccomp. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"