Archives
-
BlackHat/DEFCON 2011 talk: Breaking out of KVM
I’ve posted the final slides from my talk this year at DEFCON and Black Hat, on breaking out of the KVM Kernel Virtual Machine on Linux. Virtunoid: Breaking out of KVM [Edited 2011-08-11] The code is now available. It should be fairly well-commented, and include links to everything you’ll need to get the exploit up [...]
Aug 8th, 2011 | Filed under Computer Security, Low-level hacking -
Exploiting misuse of Python’s “pickle”
If you program in Python, you’re probably familiar with the pickle serialization library, which provides for efficient binary serialization and loading of Python datatypes. Hopefully, you’re also familiar with the warning printed prominently near the start of pickle‘s documentation: Warning: The pickle module is not intended to be secure against erroneous or maliciously constructed data. [...]
Mar 20th, 2011 | Filed under Computer Security -
CVE-2010-4258: Turning denial-of-service into privilege escalation
Dan Rosenberg recently released a privilege escalation bug for Linux, based on three different kernel vulnerabilities I reported recently. This post is about CVE-2010-4258, the most interesting of them, and, as Dan writes, the reason he wrote the exploit in the first place. In it, I’m going to do a brief tour of the various [...]
Dec 10th, 2010 | Filed under Computer Security, linux -
A brief look at Linux’s security record
After the fuss of the last two weeks because of CVE-2010-3081 and CVE-2010-3301, I decided to take a look at a handful of the high-profile privilege escalation vulnerabilities in Linux from the last few years. So, here’s a summary of the ones I picked out. There are also a large number of smaller ones, like [...]
Sep 26th, 2010 | Filed under Computer Security, linux -
Dear Twitter: Stop screwing over your developers.
I really like Twitter. I think it’s a great, fun, service, that helps enable interesting online communities, and is a surprisingly effective way to spread news and information to lots of people online. One of the things that I’ve loved about Twitter is their API, and how open and welcoming they’ve been to developers. I [...]
Sep 12th, 2010 | Filed under Computer Security -
Security doesn’t respect abstraction boundaries
The fundamental tool of any engineering discipline is the notion of abstraction. If we can build a set of useful, easily-described behaviors out of a complex system, we can build other systems on top of those pieces, without having to understand to worry about the full complexity of the underlying system. Without this notion of [...]
Mar 13th, 2010 | Filed under Computer Security -
CVE-2007-4573: The Anatomy of a Kernel Exploit
CVE-2007-4573 is two years old at this point, but it remains one of my favorite vulnerabilities. It was a local privilege-escalation vulnerability on all x86_64 kernels prior to v2.6.22.7. It’s very simple to understand with a little bit of background, and the exploit is super-simple, but it’s still more interesting than Yet Another NULL Pointer [...]
Feb 5th, 2010 | Filed under Computer Security