When trying to find buffer overflows, it is common practice to try and fill memory with lots of “A” characters. I first saw this when learning basic stack smashing techniques from Smashing the Stack for Fun and Profit, and have long wondered who did it first. Ever since, I’ve always used long strings of “A”s too (sometimes “B”s), and only recently started using better things like Metasploit’s pattern generator and offset reporter.
I’m fairly used to seeing things like this from my gdb sessions:
Program received signal SIGSEGV, Segmentation fault.
0x41414141 in ?? ()
(gdb)
It means I’ve managed to gain control of the instruction pointer, and I’m now to the stage of needing to locate and deliver a shellcode.
Over the weekend I had the pleasure of causing my kernel to do something similar, via an unprivileged userspace process, using the vulnerability discovered by Wojciech Purczynski:
[119647.578349] general protection fault: 0000 [3] SMP
[119647.578357] CPU 0
…
[119647.578759] Code: Bad RIP value.
[119647.578774] RIP [<4141414141414141>]
I hadn’t had an opportunity to play with kernel shellcode before, so I ended up learning a lot from Brad Spengler. Before the day was up, I was left staring at a root shell.
This was a nasty bug. Luckily, it’s “only” a local exploit, and only for x86_64 kernels. But that’s still a very large number of installations. Please make sure your x86_64 machines are patched against CVE-2007-4573 (for Ubuntu, this is USN-518-1).
© 2007, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.