Linux exploits

Hello, Khabrovites. On the eve of the start of the course “Administrator Linux. Professional ” our expert - Alexander Kolesnikov has prepared an interesting article, which we are happy to share with you.



We also invite future students and everyone who wants to visit the open lesson on the topic "Methods and possibilities for debugging Bash shell scripts."

---

Linux Open Source — .  Linux ,   . , : , 20 . , , . , . , .

.

, , — , , — . — , . . 

. . 2 , . , . .

, (Kernel Space), , , . — (User Space): , .

, , , . 

, , , , . . , , , . .

  Linux Debian, SUSE, Ubuntu, Arch Linux 4- .

. , , , . , .

, :

1. :

   
   
   
   
   

   1)

   
   
   
   
   

   2)

   
   
   
   
   

   3)

   
   
   
   
   

2.   .

   
   
   
   
   

3. :

   
   
   
   
   

   1)

   
   
   
   
   

   2)

   
   
   
   
   

   3)

   
   
   
   
   

, , . , - , Linux. , CVE :

CVE-2020-8835

CVE-2020-27194

CVE-2020-8835 Linux 5.5.0. ebpf



.   , . . , , : . , 32 , .

, .

.

394 — , ebpf



. 400 , 32 . , , bpf



. .

, — , 423 441. — , , (heap) . , , . Linux taskstruct



.

, root



. Linux — cred



, taskstruct



. cred



.

struct cred



472,473,474



. uid, gid, sgid



. , root



. , Windows.

, : sudo sysctl kernel.unprivilegedbpfdisabled=1

CVE-2020-27194 — ebpf



. 5.8.*. , bpf



— JavaScript . . JIT, , . , . - , 64 . , .

, , , , CVE-2020-8835. :

1.   64

   
   
   
   
   

2.   ebpf
   
   
   
   

   
   
   
   
   

   1.   taskstruct
      
      
      
      

      
      
      
      
      

3.   uid,gid,sgid
   
   
   
   .

   
   
   
   
   

. . .

: sudo sysctl kernel.unprivilegedbpf_disabled=1

?

, , , Linux — , , . (shellcode) , . , .

---

«Administrator Linux. Professional».

« Bash».

:

• Linux Experiments LAB

  
  
  
  
  

• . .

  
  
  
  
  

•