rapid7/metasploit-framework — pull request #801 by jvazquez-r7 (2012-09-18 09:57:35+00:00)
Title: fix while testing ubuntu intrepid

Module wasn't working on Ubuntu intrepid x86, while the original exploit from Jon Oberheide was working fine.

After running bot exploits with strace there seems to be an important difference:

* Original exploit:

sendmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=2471, groups=00000000}, msg_iov(1)=[{"remove@/d\0SUBSYSTEM=block\0DEVPAT"..., 88}], msg_controllen=0, msg_flags=0}, 0) = 88

* Our msf port:

sendmsg(3, {msg_name(12)={sa_family=AF_NETLINK, pid=2471, groups=00000000}, msg_iov(1)=[{"remove@/d\0SUBSYSTEM=block\0DEVPAT"..., 102}], msg_controllen=3086273419, msg_control=0, msg_flags=MSG_DONTROUTE|MSG_PROXY|MSG_EOR|MSG_WAITALL|MSG_TRUNC|MSG_ERRQUEUE|MSG_DONTWAIT|MSG_CONFIRM|MSG_FIN|MSG_SYN|MSG_MORE|0xb7f50000}, 0) = -1 ENOBUFS (No buffer space available)

My guess is we're using uninitialized data for the msghdr struct. Initializing data seems to fix the problem. The exploit generated by msf exploit now works on Ubuntu Intrepid (x86)

On the other hand added OSVDB reference.