Why Linux security has failed (for the past 10 years)

A honest look at the present (2009) situation and state of the art of Linux kernel security, and what has failed for almost a decade.

Read article

Apple Mac OS X 10.4 temp_patch_ptrace(): Nonsense in kernel-land

Read article

Linux Kernel Silent Patching: VMI write_ldt_entry() local privilege escalation

Read article
Why Linux security has failed (for the past 10 years)
Apple Mac OS X 10.4 temp_patch_ptrace(): Nonsense in kernel-land
Linux Kernel Silent Patching: VMI write_ldt_entry() local privilege escalation

October 24, 2009 | 9 minutes

Apple Mac OS X 10.4 temp_patch_ptrace(): Nonsense in kernel-land

Several software vendors realized, sometime during the 1990-2000 time-frame, that exporting system call tables within kernel address space was a bad idea. This obviously doesn’t mean anything to Red Hat and other GNU/Linux vendors who are happily providing world readable System.map files. Not like anybody needs them, though. Then again, you have to face potential funniness of contradictory measures, like Apple’s own mistakes. This article won’t talk about yet another bug introduced by a Linux developer working at Red Hat (and later silently fixed by another employee of the very same company), but an interesting issue with Mac OS X 10.

Linux Kernel Silent Patching: VMI write_ldt_entry() local privilege escalation

Once again, the Linux kernel developers delight us with their always discreet (meaning: silent, no-advisory, no-warning policy) and wonderful patching practices. Sometime between 2.6.24 and 2.6.25 a patch from a Red Hat developer was committed into the Linux kernel git tree, implementing changes to the VMI interfaces hooking some functions dealing with the GDT and LDT. diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c index 6ca515d..edfb09f 100644 --- a/arch/x86/kernel/vmi_32.c +++ b/arch/x86/kernel/vmi_32.c @@ -235,7 +235,7 @@ static void vmi_write_ldt_entry(struct desc_struct *dt, int entry, const void *desc) { u32 *ldt_entry = (u32 *)desc; - vmi_ops.