From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EB6BC433ED for ; Wed, 7 Apr 2021 20:39:12 +0000 (UTC) Received: from shelob.surriel.com (shelob.surriel.com [96.67.55.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id C8551611EE for ; Wed, 7 Apr 2021 20:39:11 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C8551611EE Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=vt.edu Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernelnewbies-bounces@kernelnewbies.org Received: from localhost ([::1] helo=shelob.surriel.com) by shelob.surriel.com with esmtp (Exim 4.94) (envelope-from ) id 1lUEwy-0005PZ-5h; Wed, 07 Apr 2021 16:38:56 -0400 Received: from mail-qv1-xf2b.google.com ([2607:f8b0:4864:20::f2b]) by shelob.surriel.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94) (envelope-from ) id 1lUEwr-0005P6-MU for kernelnewbies@kernelnewbies.org; Wed, 07 Apr 2021 16:38:49 -0400 Received: by mail-qv1-xf2b.google.com with SMTP id h3so6757074qvr.10 for ; Wed, 07 Apr 2021 13:38:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vt-edu.20150623.gappssmtp.com; s=20150623; h=sender:from:to:cc:subject:in-reply-to:references:mime-version :content-transfer-encoding:date:message-id; bh=C3kqp5Td/9JCZerOI7VqLOw+NwL5J1xa69D5ZPSTZbg=; b=yw3wK1mZftSU4NVHBVqRT3q3dLhbck9rPdw5wHei6RDZUJJ3t7Sb7CEcrUwGH5J8zn WliQzJsxFGSucvQxa+sYF8OrbZvpxx6H3t3lBKappsyrFcO0vq3m2zCUi0T4V7utu6JZ BOAqzLMoOw60FMx6qiN6bcmizny/gtmwsTcFcJglRtu1VPl6ckJral06h73F4hZpqQpg Xu8rn0Dezqbq9XLZl06ZCCXVs+Ze7MFNLcm2P/M7E/db9gIZlSjt6kzMYDa+hwXfkqiB UjkCstZ2w8P2SOeEkA5ukL10H827uVjB0mOjV+3xBcvyB4AVNMx1u9mxQDIS5Bwl07sn YVJA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:in-reply-to:references :mime-version:content-transfer-encoding:date:message-id; bh=C3kqp5Td/9JCZerOI7VqLOw+NwL5J1xa69D5ZPSTZbg=; b=MkVcYRnmy4jq2aUfc6KNN9FRsM1k0Yz8oAzcylSqhJOdEOKJo73Hms1NfXZm6p0EUA cIr+p6/4fY4YVNvIBEkHqJd+/lSyRgnKcy8Cw+cyxewttBlrDWZ5W2TpS4BIKijNmxF3 gcqDQYv7NWPOc//uSMOlxrR1RrYeahP9ARq+ybp0GZvSz5LahmzYyko+2bbjgCyKcq1q hk9QH14StvogDIjMnwVn8xp8EEzVbkmxDEtn402ZKnXqdW1e/nYKnHmKNUDfApDSPGib i1hHZkPNQP3BBVzq12eIeSqqcQhxU5xX+8dSwOv2eEwC8lSLhonSvX9JFtHeDkRpsSmX NQKA== X-Gm-Message-State: AOAM5333reznfv8tDCBT00l5/vGNVtilMLFnAllAxnu9+lsnzdVmuDnk lC08OSTqF0knWBCC5pecLKGocA== X-Google-Smtp-Source: ABdhPJzhrEwcC145g7278+sNzShCM65TW9zp1mWSdt2Cgl6ntkwzNXEFRfoXViZWxHcYphLTUehHUA== X-Received: by 2002:ad4:554e:: with SMTP id v14mr5389211qvy.49.1617827928505; Wed, 07 Apr 2021 13:38:48 -0700 (PDT) Received: from turing-police ([2601:5c0:c380:d61::359]) by smtp.gmail.com with ESMTPSA id 124sm19207212qkn.121.2021.04.07.13.38.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Apr 2021 13:38:47 -0700 (PDT) From: "Valdis Kl=?utf-8?Q?=c4=93?=tnieks" X-Google-Original-From: "Valdis Kl=?utf-8?Q?=c4=93?=tnieks" X-Mailer: exmh version 2.9.0 11/07/2018 with nmh-1.7+dev To: John Wood Subject: Re: Notify special task kill using wait* functions In-Reply-To: <20210407175151.GA3301@ubuntu> References: <20210330173459.GA3163@ubuntu> <79804.1617129638@turing-police> <20210402124932.GA3012@ubuntu> <106842.1617421818@turing-police> <20210403070226.GA3002@ubuntu> <145687.1617485641@turing-police> <20210404094837.GA3263@ubuntu> <193167.1617570625@turing-police> <20210405073147.GA3053@ubuntu> <115437.1617753336@turing-police> <20210407175151.GA3301@ubuntu> Mime-Version: 1.0 Date: Wed, 07 Apr 2021 16:38:46 -0400 Message-ID: <184666.1617827926@turing-police> Cc: kernel-hardening@lists.openwall.com, Andi Kleen , Kees Cook , kernelnewbies@kernelnewbies.org X-BeenThere: kernelnewbies@kernelnewbies.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Learn about the Linux kernel List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============3450700521673328042==" Errors-To: kernelnewbies-bounces@kernelnewbies.org --===============3450700521673328042== Content-Type: multipart/signed; boundary="==_Exmh_1617827926_108837P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit --==_Exmh_1617827926_108837P Content-Type: text/plain; charset=us-ascii On Wed, 07 Apr 2021 19:51:51 +0200, John Wood said: > When brute detects a brute force attack through the fork system call > (killing p3) it will mark the binary file executed by p3 as "not allowed". > From now on, any execve that try to run this binary will fail. This way it > is not necessary to notify nothing to userspace and also we avoid an exec > brute force attack due to the respawn of processes [2] by a supervisor > (abused or not by a bad guy). You're not thinking evil enough. :) I didn't even finish the line that starts "From now on.." before I started wondering "How can I abuse this to hang or crash a system?" And it only took me a few seconds to come up with an attack. All you need to do is find a way to sigsegv /bin/bash... and that's easy to do by forking, excecve /bin/bash, and then use ptrace() to screw the child process's stack and cause a sigsegv. Say goodnight Gracie... --==_Exmh_1617827926_108837P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Comment: Exmh version 2.9.0 11/07/2018 iQIVAwUBYG4YVgdmEQWDXROgAQKAIA/+JQc2HVjebFAqdhBguHXlMpdRbqE/TK88 QcsBwIUIzRafTVrQeQ0+9SKo7X419zxUkIziKKSdzWqoHQ5XltS3eyzR8IF/O/D1 HrDTA9d8SNGRERSQC9wSfjwBGK3Ru1kZ/2Frsr+HCf7z0h7Jh+2xp2mDc8cJNQWn Z0wJPF3EjC/zqZIuaNNFTTupSO++FpIQEAgIWOTlq2TGjuYcnaZ+UJpwhoiLK4wY WAtF8ke7xwTVWYdAfjhJAYVzeFHwaTogppZwShPZuBQIEua8Qv3WvjVtE891RM9E ahhFIDd0jVJy0lYp1FQibstKCYYYgSwV0R4EanWUPx5X3GSTyivIvgNBT4bqjaqd CMLR20uh/lr/xxXKr8fPr93i6thkrunWQO+MOVKdv6sW8BLTzUW/eK+69seEo/Di +78L4XVDYK3wX2ZCUSHbfytznoYRUXBTzPmcGn2NcX1eB93ZSB4tMPmK2dX2XEO9 58gm7dybXESOlHaOJn5MpPrHzaRyUJIhDerMEqsgITDpMcxdgfV8/SBtwlS4C+xP J1zavftL5IFdk+/MNDjcZpyhkVgMnbGXgTYiwWmW1PM485OKux3f69OK28htgA7x xIZpc3ipOPKKDEUeD9bwqk2Yh7G0AQUII8ybOsrMim3P/6sQBMa07eqj6maDyOWQ ywYJVv+FHTo= =ktc2 -----END PGP SIGNATURE----- --==_Exmh_1617827926_108837P-- --===============3450700521673328042== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies --===============3450700521673328042==--