Comments for Dividead's Blog

Comment on glibc timezone integer overflow by Jeremy Brown

Jeremy Brown — Thu, 08 Oct 2009 05:31:47 +0000

Very interesting post, nice work!

Comment on NUMA and ASLR by huku

huku — Wed, 02 Sep 2009 00:49:34 +0000

Hello dividead,

I really enjoyed both this and your previous post. It is obvious that you have a great understanding of system internals. Good work! :-)

I have a question though… Afaik NUMA is only used for Xeon and Opteron chips. Am I wrong?

Keep up the good work
./hk

Comment on Blocking between execution and main() by dividead

dividead — Tue, 21 Jul 2009 20:48:07 +0000

Didn’t you already answer that question yourself by setting the FD_CLOEXEC on another pipe descriptor you pass to the child process? If this happens at the right time in fs/exec.c that seems perfectly usable to me. Personally I would SIG_IGN the signal to have EPIPE events delivered on the descriptor, as I dislike having to deal with signals if I can prevent it. When this descriptor triggers EPIPE, unlink() the hardlink to pulseaudio, and as soon as thats done drain the pipe keeping the child blocked. Of course we have something called like hardlink with a “(deleted)” suffix waiting at this point.

I can’t think of a more elegant way right now. It would have been cool if epoll in edge triggered mode would generate an edge for a blocking write to a full pipe buffer, but alas, it doesn’t, only when it places something in the buffer.

Comment on Blocking between execution and main() by Julien Tinnes

Julien Tinnes — Tue, 21 Jul 2009 17:34:34 +0000

Yes, this is it, good job! The LD_DEBUG trick was quite popular around 2000, funny to see this was not really closed.
You solved the part where you need the child to wait for the parent to be ready. How can you also guarantee that the parent will not perform a certain action before the child is inside execve() ?

By the way, for this particular vulnerability, there is also another method to exploit it, without having to win a race at all, I’ll comment on this soon.

Comment on Foundry SuperX SSH authentication by Lviz

Lviz — Wed, 27 May 2009 11:54:51 +0000

same here @ServerIron