bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Root privileges possible via memory exploit

Summary

In January 2012 a hole became known in the Linux kernel from version 2.6.39 through which local users could gain root privileges via /proc/pid/mem. Since 2.6.39 write access had been possible there, and the check via self_exec_id could be bypassed with a child process. Jason A. Donenfeld explained the bug, and shortly afterwards exploits via the setuid program su were circulating; Android was affected too.

Ideas

  • Write access to other processes’ memory needs particularly strict checking.
  • A newly permitted access path opened a hole.
  • setuid programs such as su served as a lever for privilege escalation.
  • Android devices were also affected via the shared kernel.
  • On Android 4.0 the exploit only worked via run-as and an ADB connection.

Insights

  • New freedoms in kernel interfaces need the same review as new features.
  • Detailed explanations also speed up the development of exploits.

Facts

  • Kernels from version 2.6.39 were affected.
  • Linus Torvalds published the patch personally.

References

Critique

  • The report names no CVE identifier, which makes matching with distribution updates harder.

Remarks

  • The exploit became known as “Mempodipper”; Donenfeld later developed WireGuard.

Recommendations

  • Reduce setuid programs to a minimum.
  • Where appropriate, restrict access to other processes’ /proc entries with hidepid.

Read the original article

Search the Web Archive

g · 2003

AMD presents flash memory with security functions

In January 2003 AMD presented the Am29PDL640G flash memory with 64 megabits and multi-level security functions, including 64-bit password protection. It was intended for mobile phones and set-top boxes and was meant to prevent hackers from making calls at other people’s expense or pirating pay TV. The chip was also supposed to extend battery life.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2026

Ongoing attacks endanger 10,000 firewalls

At the end of 2025 Fortinet warned of ongoing attacks on a FortiOS hole patched since July 2020 (CVE-2020-12812), which according to Shadowserver was still exploitable on around 10,000 firewalls. Attackers use it to bypass two-factor login via FortiToken by changing the upper and lower case of the user name. Local users authenticated via LDAP and assigned to a group are affected.