Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1030579AbWJCVyI (ORCPT ); Tue, 3 Oct 2006 17:54:08 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1030580AbWJCVyH (ORCPT ); Tue, 3 Oct 2006 17:54:07 -0400 Received: from messel.emse.fr ([193.49.175.1]:23761 "EHLO messel.emse.fr") by vger.kernel.org with ESMTP id S1030578AbWJCVxv (ORCPT ); Tue, 3 Oct 2006 17:53:51 -0400 Message-ID: <4522DBED.4090702@gmail.com> Date: Tue, 03 Oct 2006 23:53:49 +0200 From: endrazine User-Agent: Thunderbird 1.5.0.4 (X11/20060625) MIME-Version: 1.0 To: =?ISO-8859-1?Q?Br=E1ulio_Oliveira?= CC: linux-kernel@vger.kernel.org Subject: Re: Fwd: Registration Weakness in Linux Kernel's Binary formats References: <1df1788c0610031425p4f1ca206teb05590a91eb7659@mail.gmail.com> In-Reply-To: <1df1788c0610031425p4f1ca206teb05590a91eb7659@mail.gmail.com> X-Enigmail-Version: 0.94.0.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2144 Lines: 60 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I can't say if the vulnerability is real, but I do know pdfs are _unsafe_ those days... Regards, endrazine- Br?ulio Oliveira wrote: > Just forwarding.... > > ---------- Forwarded message ---------- From: SHELLCODE Security > Research Date: Oct 3, 2006 4:13 PM > Subject: Registration Weakness in Linux Kernel's Binary formats To: > undisclosed-recipients > > > Hello, The present document aims to demonstrate a design weakness > found in the handling of simply linked lists used to > register binary formats handled by Linux kernel, and > affects all the kernel families (2.0/2.2/2.4/2.6), allowing > the insertion of infection modules in kernel? space that can be > used by malicious users to create infection tools, for example > rootkits. > > POC, details and proposed solution at: English version: > http://www.shellcode.com.ar/docz/binfmt-en.pdf Spanish version: > http://www.shellcode.com.ar/docz/binfmt-es.pdf > > regards, -- SHELLCODE Security Research TEAM > GoodFellas@shellcode.com.ar http://www.shellcode.com.ar > > > - To unsubscribe from this list: send the line "unsubscribe > linux-kernel" in the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ - To unsubscribe > from this list: send the line "unsubscribe linux-kernel" in the > body of a message to majordomo@vger.kernel.org More majordomo info > at http://vger.kernel.org/majordomo-info.html Please read the FAQ > at http://www.tux.org/lkml/ > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFItvszX6JtL3KgRURAq6xAJ4pXYuqjAwxOY8H+/yU5WhRmBDVVgCgnwNr JusXDby1dLMzAR/t4/mKf1c= =3tmT -----END PGP SIGNATURE----- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/