Local Root Exploit in Linux 2.4 and 2.6

Anonymous Coattails writes "Summary from the advisory: 'Locally exploitable flaws have been found in the Linux binary format loaders' uselib() functions that allow local users to gain root privileges.'"

Comments

*sits back*

[Anonymous Coward]

*awaits justifications and explanations of why this is nothing like Microsoft*

Re:*sits back*

[ackthpt]

*awaits justifications and explanations of why this is nothing like Microsoft*

Because in this case Linus Torvalds is our new overlord, and I for one, welcome him.

Re:*sits back*

[Lodragandraoidh]

"We are sorry, all circuits are busy..." - Microsloth Help Desk

"You can download the fix

• here

..." - Any Linux website within a days (perhaps hours) of the report.

Re:*sits back*

[identity0]

I was going to make a comment about "rounding up workers for underground C mines", but I figured that didn't sound painful enough.

So, I would like to remind Linus that I will be very useful in rounding up workers to toil in the underground Perl mines.

Re:*sits back*

[darc]

Yeah yeah, that's the responsible thing to say. But responsible stuff is sooooooooo boring. I mean, if we were all responsible people that wanted stability, we'd all be running kernel 2.2, Apache 1.1, many year old revisions of programs patched to all heck, never install any packages that aren't yet at least of legal age, and still tout ISA support as a bleeding edge feature.

Hmm. Wait, I think I just described Debian Stable.

*is hit by a gigantic potato from the debian crowd*

(Yes, I am aware that stable is called Woody, and the last version was called Potato. But if I said "is hit by a gigantic woody..." i'd probably get murdered. Oops.)

Re:*sits back*

[EnronHaliburton2004]

Because in this case Linus Torvalds is our new overlord, and I for one, welcome him.

Dude, he was our new overlord like 10 years ago, get with the program...

Re:*sits back*

[Alsee]

Potato?? Woody??

Jeez. What the hell are they going to call the next release of Debian stable? Boner?

-

Re:*sits back*

[m50d]

I'm willing to compare apples to apples, but if you want me to include the major apps installed on linux distros, you should also include lots of external software for windows - some of it third party, since there doesn't seem to be an MS alternative to (for example) the GIMP.

So I guess the question is...

[Anonymous Coward]

Does this exploit run Linux?

How the hell

[BoomerSooner]

How do people find this stuff? Amazing. Open source is astounding.

When do I get my kernel update?

Re:How the hell

[pasde]

When do I get my kernel update?

No worry. I ve already installed it for you.

won't be exploted here!

[Dominatus]

It's a good thing I've got the patch downloa

Funny you should mention...

[Yaa 101]

I need no exploit to gain root privileges, I just login...

Re:That's why MS will rule the world.

[spac3manspiff]

Mod parent -1 denial.

lets hope no-one discovers

[Anonymous Coward]

su

Re:What, no remote exploit?!?

[EnderWiggnz]

you mean to tell me that people have found exploits in bind and sendmail?

no way - they're perfect open source programs. model programs, so to speak.

next, you'll tell me that x is a crufty, inefficient kludge.

Re:What, no remote exploit?!?

[mm0mm]

where as every nearly every Windows flaw is remotely exploitable?

Don't you think it's more convenient for you to be able to hack multiple machines over LAN? Another reason to choose Windows over Linux.

I'm safe!

[ferratus]

It doesn't work on my Gentoo box running 2.6.9 so I'm safe. This machine will not be hacked.

It's a good thing I have telnet running on that box so that I could try it remotly though.

Re:Local Access is always a trump card

[arose]

Local as in "need user level access" not "need screwdriver level access".

Re:What, no remote exploit?!?

[Dr.Zap]

" Why is it every nearly Linux flaw is locally exploitable, where as every nearly every Windows flaw is remotely exploitable?"

That would be Microsoft's superior networking ability, along with it's user (or abuser) friendly interfaces!

Re:What's truly funny

[Anonymous Coward]

STFU! You should be posting these kinda things AC, like me!

Re:Distribution restrictions

[Anonymous Coward]

Nah...this is smart. Copyright the exploit code, and then once a worm is spread, he can sue everyone for copyright infringement.

Here's the exploit (-;

[MacJedi]

#!/bin/sh
echo "1|nux r007 3xp10|7 by 1c4m7uf"
cd /tmp
cat >ex.c <<eof
int getuid() { return 0; }
int geteuid() { return 0; }
int getgid() { return 0; }
int getegid() { return 0; }
eof
gcc -shared ex.c -oex.so
LD_PRELOAD=/tmp/ex.so sh
rm /tmp/ex.so /tmp/ex.c

what's that sound I hear?

[Trepidity]

It's the sysadmins of University email and webservers across the country going apeshit as suddenly the entire student body potentially has root...

Re:what's that sound I hear?

[scottking]

I wish there was a +1 Used 'Apeshit' in a sentence modifier.

here's a patch

[antonakis]

...though a bit big. www.openbsd.org

Thank God...

[mackman]

Thank God I run Firefox!

Re:isec.pl's guys rule

[gbjbaanb]

Perhaps someone should offer a job to those guys so they can audit parts of the kernel better

Yeah, lol. Microsoft.

Oh sorry, I though you meant, 'someone should offer these guys a job so they can audit the kernel better to find *more* exploits, allowing MS to publicise all these anti-linux holes' ;)

Re:FreeBSD

[Anonymous Coward]

You need clever people to find an exploit on FreeBSD.
You just need a kid to crash your Linux box several times in several different ways.

That's right! Stick with 2.0.36

[Tom7]

That's why I've been sticking with 2.0.36 all these years. I haven't seen a security advisory for it in ages.

Dangit...

[catdevnull]

All those MCSE dorks down the hall are gonna give me sh*t for the next week.

Reminds me of a punchline to my favorite Scottish joke:
"Aye, lad...ya screw ONE goat..."

Re: bugs in code

[FireBreathingDog]

I don't know what sigma level Microsoft is at but with 2 defects per 100 is 360000 per 1,000,000 lines of code. That puts them at a sigma level between 3 and 4. The Majority of software makers are below that. Yet if MS were six-sigma (they sell software that tracks it) they would have only 61 defects for those 18 million lines of code.

That's why you should always put curly braces on their own lines, to increase your total lines of code. Helps achieve a more favorable sigma.