New kernel vulnerability

[mar]

Compiled without problems with devastor's patch.

[quags]

the patched fixed compiling problems I was having as well

[devastor]

I updated the patch to fix a missing semi-colon in fs/binfmt_elf.c

It caused a compilation failure when support for PAX's new softmode was enabled

[spender]

I've updated the patches on the link, and added one for grsecurity 2.0.
Let me know if there are any problems with these updated patches.

-Brad

[underattack]

the updated patch works fine here (two different systems, one PIII/SCSI and one Athlon/IDE).

[siti]

The 2.0 patch for 2.4.25 works fine for me, on an Athlon & Athlon-XP

[Sea-you]

I compiled the updated patch on several machines without any problem, the boxes are working fine (logserver, dns servers, mail servers, proxy servers, webservers).

[T2000]

I'm missing the following things in "make menuconfig"

[*] Enforce non-executable pages x x
x x [ ] Paging based non-executable pages x x
x x [*] Segmentation based non-executable pages x x
x x [ ] Emulate trampolines x x
x x [*] Restrict mprotect() x x
x x [ ] Disallow ELF text relocations (DANGEROUS) x x
x x [*] Address Space Layout Randomization x x
x x [*] Randomize user stack base x x
x x [*] Randomize mmap() base x x
x x [ ] Randomize ET_EXEC base

where are these features in the new patch for 2.4.25?
There is the ne Pax, where I can turn on Softmode but thats all.

[PaX Team]

where are these features in the new patch for 2.4.25?
There is the ne Pax, where I can turn on Softmode but thats all.

you have to enable at least one ELF marking scheme (or ACL hook, depending on how you want to control PaX flags). a safe bet in your case is probably to use EI_PAX at least which was the default so far.

[T2000]

Thanks. That worked for me. But its really tricky

[Serp0]

hi i try with 2.4.24 + last grsecurity for this kernel
and the mremap #2 bug its work is vulnerable

i want to comment you

now i compile development last grsecurity + 2.4.25 +grsec.patch
and work very good



see ya