mailing list archives
Re: CLONE_NEWUSER|CLONE_FS root exploit
From: Eugene Teo <eugeneteo () kernel sg>
Date: Thu, 14 Mar 2013 08:59:04 +0800
On 13 Mar, 2013, at 11:39 PM, Sebastian Krahmer <krahmer () suse de> wrote:
Seems like CLONE_NEWUSER|CLONE_FS might be a forbidden
During evaluating the new user namespace thingie, it turned out
that its trivially exploitable to get a (real) uid 0,
as demonstrated here:
The trick is to setup a chroot in your CLONE_NEWUSER,
but also affecting the parent, which is running
in the init_user_ns, but with the chroot shared.
Then its trivial to get a rootshell from that.
Tested on a openSUSE12.1 with a custom build 3.8.2 (x86_64).
I hope I didnt make anything wrong, mixing up the UIDs,
or disabled important checks during kernel build on my test