How to exploit the x32 recvmmsg() kernel vulnerability CVE 2014-0038

[signa11]

http://blog.includesecurity.com/2014/03/exploit-CVE-2014-0038-x32-recvmmsg-kernel-vulnerablity.html

[Aqwis]

On recent versions of Ubuntu, ordinary users do not by default have access to either System.map or any decompressed kernel images (I did however notice that on my RHEL system they have read access to System.map), and ptmx_fops does not appear in kallsyms. Is ensuring correct permissions on System.map and kernel images enough to render the exploit harmless?

Edit: On second thought, given that the kernel isn't custom, using files from another system with the same kernel is a trivial workaround.

[username42 → Aqwis]

Removing read access gives an illusion of security. To avoid this false impression, it is better to leave the permissions.

[rwmj → Aqwis]

Removing read access is security by obscurity. You can grab the system map or kernel image from any Ubuntu repo.

Even if it is a custom kernel, an exploit that can read kernel memory can search for kallsyms within the binary. I wrote code to do this once, it's quite fun.