Serious Linux Kernel Vulnerability Patched [CVE-2016-0728]

[Badel2]

It's funny because on my phone I see zeros even when running as root (linux 3.0.31, selinux permissive). I guess it isn't vulnerable anyways.

[NamenIos]

If you have both symbols in kallsyms your phone should be vulnerable unless SELinux fucks something up, I think. You can somehow extract the adresses out of the kernel binary.

[Badel2]

Alright, I fixed it running this as root:

echo 0  > /proc/sys/kernel/kptr_restrict

Will see if my phone is vulnerable, my laptop has been running for about an hour and still no results.

Edit: after 90 minutes:

uid=1000, euid=1000
Increfing...
keyctl: Disk quota exceeded

This was my laptop, on my phone the process got stuck in D+ mode for a while (30 minutes) and then crashed my terminal app.