back

by LinuxBender·10y ago·view on hn ↗
Tested on CentOS 7, fully patched.

    [ohadmin@localhost shm]$ ./cve_2016_0728 PP_KEY
    uid=99990, euid=99990
    Increfing...
This is taking a long time. I disabled SELinux and it has been cranking away for a while now.

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND
    1140 ohadmin   20   0    8428    388    296 R 100.0  0.0   9:25.17 cve_2016_0728
No need to test on CentOS 6. Forgot how ancient that kernel is.

Update: I am not having any luck getting this to work on CentOS 7. I even completely disabled SELinux (selinux=0 vs setenforce 0) Anyone else getting this to work?

2 comments
That's not how you execute binaries, just "./cve_2016_0728 PP_KEY" is the correct syntax
Yes sorry. I will make the cheap excuse that I am recovering from food poisoning and don't quite have it all together. Thankfully I don't manage nuclear weapons, so we are all safe for now.
You need to update the addresses of commit_creds() and prepare_kernel_cred() as per this: https://news.ycombinator.com/item?id=10931954
The best I can get is an oops panic on CentOS 7.

It appears smaps may be preventing the exploit from working.