Comments on: Linux kernel 2.6.31 perf_counter_open exploit

By: ties

ties — Sat, 31 Oct 2009 00:18:46 +0000

Write more !

By: argp

argp — Sun, 18 Oct 2009 14:04:47 +0000

Nice post.

By: core

core — Tue, 13 Oct 2009 21:41:32 +0000

excellent writeup!

By: xipe

xipe — Sat, 10 Oct 2009 15:16:09 +0000

Thank you Keen
- Xipe

By: Keen Observer

Keen Observer — Sat, 10 Oct 2009 06:16:50 +0000

Also, credits should go to Silvio Cesare for being the first to use iret in 03, so there!

By: Keen Observer

Keen Observer — Sat, 10 Oct 2009 06:06:33 +0000

Spender has always been out for glory, it’s common news that he stole the whole grsecurity ideology, I mean — a bug was discovered, and exploited over a week ago, and he scouts the internet for blogs that talk about it without giving credit to him and qaaz, funny how it’s not qaaz that complains — Good work xipe, continue posting more, I’m sure a lot of people congratulate your efforts.

By: c

Fri, 25 Sep 2009 03:15:13 +0000

Xipe, thanks for the walk-through. For those not familiar with kernel exploitation, it\’s a good read and educational. Spender, if you read this, your code and research are top-notch, and grsecurity is a valuable addition to our world. But your apparent arrogance and harsh criticism of others, including the elitist arrogance of calling others idiots sends a big fat pointer towards your own ego-trip. I\’m sure you popped out of the womb knowing everything. Cool the ego and life will be better.

By: xipe

xipe — Thu, 24 Sep 2009 18:33:44 +0000

spender, concerning the code that doesn’t work on 4k stacks … I wrote it as documented in Understanding Linux Kernel 3th edition … please just stop
For people reading this and wanting to run the exploit on a 4k stack, you should change the “movl $0xffffe000,%%eax ;” with “movl $0xfffff000,%%eax ;”
Best regards,
- Xipe

By: spender

spender — Thu, 24 Sep 2009 18:17:54 +0000

I wasn’t asking credit for myself (since he obviously hadn’t seen the work I had done), just for the person whose code they ripped (including the get_stack_top code which doesn’t work on 4k stacks). It’s common courtesy.

By: dcl

dcl — Thu, 24 Sep 2009 17:55:05 +0000

Yeah… heaven forbid someone use the documented way to return across ring boundaries. Brad, you do good research. I’ll give you that. But you sure do fucking whine and cry a lot about shit. Does your ego really not get fed enough? Jesus man..