No ELF Vulnerability in 2.6 Kernel

gaijincory writes "Greg KH, the co-maintainer of the 2.6 kernel has posted a comment on lwn.net confirming that there is indeed no such ELF vulnerability as spelled out by Paul Starzetz on isec. The bug was originally thought to be particularly nasty, allowing a malicious user to gain elevated privileges using a carefully crafted binary which would exploit the kernel's Executable and Linking Format. The bug's author confirmed that no one has been able to repro the exploit."

Comments

No ELF vulnerability eh?

[NightWulf]

What about the DWARF and GNOME vulnerabilities though? Eh where's your answer now Greg?

Re:No ELF vulnerability eh?

[smittyoneeach]

Someone should have a DROW with him.

Re:No ELF vulnerability eh?

[mikrorechner]

Just FYI:
DWARF (Debug With Arbitrary Record Format) is a format for debugging information for ELF files.

(Yes, I know the parent is joking.)

Re:No ELF vulnerability eh?

[Taladar]

Especially since Dwarfs and Gnomes are smaller than Elves and thus fit through smaller security holes...

Re:No ELF vulnerability eh?

[tanek]

Aw come on, don't be such a TROLL.

Re:No ELF vulnerability eh?

[maxwell demon]

Well, let's see if I can get a cheap Karma, too :-) (However I guess it will just end up Funny with several Overrateds ...)

GNOME (GNU Network Object Model Environment) is a desktop environment.

GNU of course is short for GNU's Not Unix, so the second-level expansion of GNOME is GNU's Not Unix Network Object Model Environment. Which indeed is a true statement, since GNU indeed is no Unix Network Object Model Environment.

Of course recursive expansion of GNU does no good. GNU's Not Unix Not Unix doesn't make much sense. GNU's Not Unix Not Unix Network Object Model Environment doesn't sound any better.

BTW, are there any GNU vulnerabilities in the Linux kernel? You know, I'd not like to have a wounded GNU in my computer. It would only give me trouble with the animal welfare activists. Of course DWARF vulnerabilities could cause trouble with Amnesty International, so it's also something you really want to check.

Re:No ELF vulnerability eh?

[Anonymous Coward]

Don't forget OGRE (http://www.ogre3d.org/)

Re:No ELF vulnerability eh?

[CamilaAcolide]

Ahhh, just like old times... "MY DWARF IS GONNA DEBUG THAT ELF!" "OK, ROLL 1D20" ... "YOU MISSED, THAT ELF HAS NO VULNERABILITIES!!"

Re:No ELF vulnerability eh?

[Anonymous Coward]

And GNO/ME is a Unix-like environment for the Apple IIGS (see here).

I think there might also be some kind of program launcher or something for Unix called GNOME which is newer, not sure. :-)

Re:No ELF vulnerability eh?

[Anonymous Coward]

Does that mean that DWARFs are in alliance with ELFs agains GNOMEs?

Re:No ELF vulnerability eh?

[Ramscoop]

Hmmm... Does my name, then, make me vulnerable?

/Stefan Elf (really!)

Oh _that_ makes sense

[/ASCII]

I saw this story on OSnews today, but they made it out to be about the Hyperthreading issue. But that didn't make any sense since that is not ans OS bug at all, but a hardware issue. (If it is evan an issue)

Re:Oh _that_ makes sense

[Erik Hensema]

Indeed, osnews clearly has the two issues confused.

Re:Oh _that_ makes sense

[Anonymous Coward]

evan?

You must mean "even", but then again, English is probably not your primary language.

Re:Oh _that_ makes sense

[/ASCII]

Thank you captain obvious

Why so confident?

[m50d]

They've tested it and been unable to reproduce the vulnerability. But vulnerabilities are tricky things. I'm glad they still bothered to patch the kernel.

Re:Why so confident?

[caluml]

I made it work by running:

# echo 992FE4:336FF00 > /dev/kmem

as root.

Re:Why so confident?

[tehshen]

Don't do that.

Re:Why so confident?

[maxwell demon]

Hmmm ... this gives me an idea. You can extend a file from the shell by using the >> operator on it. Maybe I might be able to double my memory for free by just doing cat /dev/kmem >> /dev/kmem.

This technique could have other uses as well. Your hard disk is too small? Well, double your hard disk space with cat /dev/hda >> /dev/hda. You can even make a floppy as large as your hard disk by typing cat /dev/hda >> /dev/fd0!

Well, actually I think I'll make my main memory and disks grow infinitely:

cat /dev/zero >> /dev/kmem & cat /dev/zero >> /dev/hda &

SCNR :-)

Re:Why so confident?

[caluml]

Instead of bothering with your whole disk, if you just upgrade the first 512 bytes of the disk, you get the same effect. Try

dd if=/dev/zero of=/dev/hda bs=1 count=512

Of course, I don't recommending doing anything you learnt from a webpage unless you fully understand what it does.

Re:Why so confident?

[shaitand]

The sad thing is that if everyone took your recommendation then nobody would understand the things they find on webpages.

Re:Why so confident?

[caluml]

Actually, it doesn't do anything on Gentoo 2.6 on AMD64. I'm sure it used to in the 2.4 days. Instant hard lock. Although, thinking about it - it might be part of the GRSec restriction I have compiled into the kernel - to disallow things from writing to /dev/kmem.

[ ] Deny writing to /dev/kmem, /dev/mem, and /dev/port

Nope, didn't choose that option.

Re:Why so confident?

[Anonymous Coward]

For the uninitiated, this wipes your MBR/partition table. Generally not recommended.

Re:Why so confident?

[pimpsoftcom]

Do NOT do this. The first 512 bytes of a hard drive make up the boot sector of the drive. If you do what he showed you, it will overwrite the boot sector of the hard drive in question (In this case /dev/hda, the master and first hardrive on the first ide channel). This would make the computer unbootable!

If the tree falls in the woods, no-one hears it...

[meuon]

Is it a bug, if it can't be reproduced? Not yet, anyway. Did he really create this vulnerability problem, at least once? - so many people get sloppy on scientific method, conditions, variables.. and recording the details. Especially me. And what they think happened, did not.

Re:Hold on CowBoy

[Anonymous Coward]

5 minutes to be precise. May be world is coming to an end and Hemos want to post as many stories he can before it.

The bug's author?

[Looke]

Who's "the bug's author"? He who discovered it or he who wrote the code?

"I'm a bug author. Today I've written five bugs!" Sounds like a nice career choice ...

Re:The bug's author?

[Anonymous Coward]

A career choice made by a large portion of Microsoft's employees...

Re:The bug's author?

[Jace of Fuse!]

Shhhhhhhh!!! That's secretly what MANAGERS are doing, and all this time you thought they were totally worthless!

Huh

[Anonymous Coward]

"The bug's author confirmed that no one has been able to repro the exploit"

That's really comforting.

Re:Huh

[Anonymous Coward]

lol, I don't know which part of that sentence to bitch about first.

I guess no one has re-achieved professional status through this exploit. Does bug-authoring pay well these days?

Re:Huh

[Anonymous Coward]

Does bug-authoring pay well these days?

I'd say yes. :o)

Re:Huh

[ThePromenader]

Most importantly, can the bug's authour able to reproduce the exploit? And if so, under what conditions? Shouldn't this be the subject of a report rather than an article?

Thoughts in my head at the moment...

[suitepotato]

First, the obligatory joke to set the questions:

According to Starzetz report, the flaw is in the function elf_core_dump(), (...)

That writes itself. Adding in references likening this to bears and woods is optional and subliminal.

Anyhow, if there is an ELF core dump bug and no one else steps in it, does it really matter? Did it really happen?

Do we dump the kernel, insist on a grooming of all ELF involved code, and rebuild and recompile?

What is the threshold anyhow for reproducing a bug? How many people must do it? If only one person reports activating the bug, do we ignore all their documentation of the event as if it was spurious because we couldn't do it? Do we wait till a malware write manages it?

What is the proper level of concern here?

Re:Thoughts in my head at the moment...

[r6144]

There is a bug if the code does not always work the way its author intended (i.e. it would bomb out if some more assertions are inserted). Sometimes the code still happens to work in all cases, but it is still prudent for the kernel developers to fix the code so that it is kept clean.

Of course, if the bug is not exploitable, system admins might delay updating the kernel if a reboot is inconvenient, but for kernel developers, every bug should be fixed whenever possible.

As an Elf...

[Zakabog]

Speaking for myself, and elves everywhere, this is great news. I can finally use my favorite OS without worrying about any attacks I'm opening myself to.

Re:If the tree falls in the woods, no-one hears it

[Richard_at_work]

Or it can simply be a fact that modern computer systems (both hardware and software) change states so much every second that its next to impossible to recreate the exact state required without having a rig that recorded the origional state and set it up as a test system. It could be a very obscure bug that requires some very exacting conditions that only occur extremely rarely, thats why noones been able to replicate it. Im sure that in the course of development, all programmers have come across a random one time only bug that causes you to shrug your shoulders, watch out to see if it ever happens again, but get on with life.

isec rules

[diegocgteleline.es]

They've discovered most of the linux kernel vunerabilities in the latest ~2 years or so, and they've always disclosed them friendly, so I don't think they deserve all this noise. It's better to think that there're vulnerabilities and fix them than the contrary.

Re:isec rules

[Anonymous Coward]

In fact they've found 10 out of the last 9 vulneratbilities.

Many Exploits don't work as advertised

[HidingMyName]

Our research group works in intrusion detection. As part of our research we wanted to generate host based intrusions in a Linux environment (Linux 2.6.2 kernel running on Fedora Core 2 without security patches applied).

We found that almost all the exploits we tried did not work as advertised. Yet the security advisory lists blindly post these as if they work. While the design/implementation issues may be present in a range of kernels, I'm beginning to think that these exploits are not vetted, and that the exploit writers look for a possible weakness and publish a piece of software that sort of pokes at it and claim success. It is very frustrating, since if the vulnerability can be exploited, a bogus exploit gives a false sense of security (since you can't compromise the system using it).

Re:Many Exploits don't work as advertised

[petermgreen]

one thing i think is an issue is its hard to make exploits that work against a range of kernels as offsets etc change. but with some effort most of them could be adapted to other kernels which have the bug but need slightly different numbers to exploit it.

its not like the ms world were there are very few builds all released by ms. with linux anyone can make thier own build and its very likely that an exploit will need tweaking for each one.

Re:Many Exploits don't work as advertised

[tiny69]

There are several possible causes for this.

The mostly likely one is that exploits are intentionally broken when released. The reasons why are numerous and have been discussed before. But it's common to find exploits that have intentional programming errors. Every so often, an exploit author will release a "working" exploit on BugTraq. When this happens, the author is typically flammed because he didn't break the exploit.

Another common cause is the author didn't design the exploit to be portable. If the author returned to libc in the exploit and they wrote it on say a Slackware system, the exploit probably will not work as written on FC2.

There are times when vulnerabilities exist only when a complex list of environmental conditions are met. A certain kernel version, using a certain version of libc, compiled with a certain version of gcc with a particular compiler option, on a particular filesystem.....

Re:Many Exploits don't work as advertised

[Anonymous Coward]

This is most likely because FC2 uses a no-exec stack and address randomization.

Exploits released to the lists are for generic linux systems without these protections.

Don't worry though, you will still be owned, but just not by public exploits.

Re:Many Exploits don't work as advertised

[HidingMyName]

one thing i think is an issue is its hard to make exploits that work against a range of kernels as offsets etc change. but with some effort most of them could be adapted to other kernels which have the bug but need slightly different numbers to exploit it.

It is hard to say, the exploits are typically released with mysterious hard coded values in them, with no documentation of how those values are computed. Also many exploits claim to exploit race conditions. Often, the vulnerability these folks write about seems plausible. Other times these folks just make wild claims about what kernel versions they think are vulnerable but when I go read the kernel source I see that the vulnerability was closed. There is definitely a need to standardize testing and analysis of exploit code and vulnerabilities, and a need for places that publish such data to vet their data, to screen out the poseurs and focus on the credible security researchers.

Re:Many Exploits don't work as advertised

[HidingMyName]

The mostly likely one is that exploits are intentionally broken when released. The reasons why are numerous and have been discussed before. But it's common to find exploits that have intentional programming errors. Every so often, an exploit author will release a "working" exploit on BugTraq. When this happens, the author is typically flammed because he didn't break the exploit.

Unfortunately the effort of trying to find the bug is often large, and many times when I read the kernel or application code the claimed vulernability is not present in a version that the exploit writer claims is susceptible. Given the quality of exploit code I've seen written recently, it may be unintentionally broken :-). Remember, raising false alarms helps the bad guys, perhaps if they can't safely publish a working exploit they should not publish any.

Another common cause is the author didn't design the exploit to be portable. If the author returned to libc in the exploit and they wrote it on say a Slackware system, the exploit probably will not work as written on FC2.

But these authors make all sorts of claims about what environments are vulnerable, no?

There are times when vulnerabilities exist only when a complex list of environmental conditions are met. A certain kernel version, using a certain version of libc, compiled with a certain version of gcc with a particular compiler option, on a particular filesystem.....

That may be true. There certainlly is a need for a good test facility coupled with the repositories. Being fast and wrong in disclosing vulnerabilities is not nearly as helpful as being right.

Re:Many Exploits don't work as advertised

[iabervon]

Most likely, there is some other factor which is preventing the exploit from working. So the vulnerability is actually exploiting some bug, but then some other check prevents anything untoward from happening. Ideally, there would be some way of checking the integrity of a process or of the system, which would identify after the fact that an exploit violated the security model in some way that had little effect (e.g., a function returned to an unmapped address, indicating a stack attack failure due to randomized memory arrangement).

In most cases, anyway, a partial exploit leads to a child process segfaulting rather than exiting normally, which is a pretty good test; it indicates something's wrong, even if it doesn't matter for some other reason. (And it's always possible that there could be a way around the check that caught the first try)

It would also be nice if there was a kernel memory location for proof-of-concept exploits to write, and a root-only syscall to write it. That way, you could have a simple demonstration that an attack got to write kernel memory or got root, without needing to determine what the exploit does, how to verify that it needs to work to do it, and how to clean up after it to try again.

Re:Many Exploits don't work as advertised

[zygut]

... or even more evil, a certain proprietary source company paying people who know what they are doing to write passable exploits that don't actually work, flood us with these and Linux starts to look less and less secure in comparision with their numbers of security vulnerabilities.

Re:Many Exploits don't work as advertised

[hawk]

When this happens, the author is typically flammed because he didn't break the exploit.

Important coded is being maintained by flim-flam artists?

:)
hawk

2.6 may be fine, but 2.4 isn't

[CoolQ]

All I can say is, some jerk bit my 2.4.21 system with this bug. This past week has not been a happy week for me.

--Quentin

Re:2.6 may be fine, but 2.4 isn't

[Anonymous Coward]

Probably not this bug, anyway. 2.4.21 is extremely old (will be 2 years old in two weeks time), and has a number of other vulnerabilities (including several other elf bugs). Step into 2005, upgrade to 2.4.30 :-)

Re:2.6 may be fine, but 2.4 isn't

[MerlinTheWizard]

2 years may be extremely old for the Linux kernel, but it's like brand new for any Windows kernel...

Re:2.6 may be fine, but 2.4 isn't

[Anonymous Coward]

Isn't the Windows kernel patched every two weeks?

Re:2.6 may be fine, but 2.4 isn't

[MerlinTheWizard]

Nope, I think it's once a month, at most. And it's not particularly the kernel that gets patched, but various components. I believe the kernel itself is hardly ever modified...

Re:If the tree falls in the woods, no-one hears it

[Eternally optimistic]

It could also be that the original analysis as wrong, and the priviledge escalation was due to the exprimental setup, not a problem in ELF.

What about 2.4???

[Anonymous Coward]

Has anyone confirmed the bug in 2.4?

Re:If the tree falls in the woods, no-one hears it

[JFitzsimmons]

If the conditions for an exploit are so specific that is is hard to create them even if you're trying then the exploit isn't all that dangerous...

Re:If the tree falls in the woods, no-one hears it

[Anonymous Coward]

"Im sure that in the course of development, all programmers have come across a random one time only bug that causes you to shrug your shoulders, watch out to see if it ever happens again, but get on with life."

I had a project manager once who had a saying: "If it didn't happen twice, then it didn't happen once."

V2.6 kernel of what?

[Anonymous Coward]

Yes I know the whole world revolves around Linux, but it would still be nice if articles like this wouldn't just take for granted that everyone knows what they're referring to, when it isn't named anywhere.

Bug author == programmer

[Urusai]

And I call it job security, FYI.

Re:If the tree falls in the woods, no-one hears it

[Jeff DeMaagd]

If it really is a bug, then the people that claim its existence should devise a more reliable means of replicating the bug.

Re:If the tree falls in the woods, no-one hears it

[Jeff DeMaagd]

What I didn't say is that there's a certain level of responsibility to the person reporting a problem. If they want a claim to fame, then they should be able to prove its existence, rather than making everyone else work furiously track it down, because for all anyone else knows, it could be a complete fluke at best, or at worst, a total fraud.

Paul's earned the benefit of the doubt

[Anonymous Coward]

Paul has found a metric shit-ton of extremely subtle and interesting flaws in Linux. If you google for ihaquer@isec.pl, you'll see that he's a world class security researcher. I don't know him personally, but as someone who does this kind of research for a living, it's obvious to me that he has the right mix of technical acumen and destructive creativity necessary for doing high-end vulnerability research.

All I'm saying is that if he's wrong, then no one should begrudge him a mistake in light of his other findings. That said, he's probably not wrong.

Re:Paul's earned the benefit of the doubt

[tota]

I agree, he has come up with some very interresting bugs in the past. It is just that this one is not one of them.

It is a shame to see that this bug prompted the immediate release of a new 2.6.11.x stable series patch, when other real bugs did not and took over 10 days from discovery to patching. (see latest .11)...

I don't think that the new and improved stable release system is working perfectly yet.

Re:If the tree falls in the woods, no-one hears it

[shaitand]

'I had a project manager once who had a saying: "If it didn't happen twice, then it didn't happen once."'

Was he a zen monk? If you follow that philosophy then all occurances are first occurances and therefore never happen, causing the next occurance to again be the first.

Re:If the tree falls in the woods, no-one hears it

[Creepy Crawler]

How very wrong..

A while back (in '92) there was the 'PS' bug.

Because ps lists full processor charts of whats running, how much cpu time, and how much mem used up, it requires root access (hence a suid root bit set).

When you run it, it would create a /tmp/.root/ps exec file that woukld then proceed to copy state from the kernel and then be read back into the real PS. This file would only last 1/1000 of a second before rm got it.

Now, how would you hack a system like this to get root? On this specific SUN system, /tmp did not have group sticky on and so it didnt control who overwrote others' files. Turns out if you do a timed attack (of calling ps, moving /tmp/.root/ps to your ~, and then edit it to be a shellscript that calls bash), root was easy to get.

Since this depended on a variable on state, you would run it in a script that called ps about 5000 times, and then BAMN! You have root.

I guess getting root isnt all that dangerous when you have to the attack some 5k times... Now is it?

what about

[Anonymous Coward]

But what about all of those a.out vunrebilities that are out there right now

Re:If the tree falls in the woods, no-one hears it

[Mornelithe]

Yes, but most people don't follow every clever little maxim to their potentially absurd logical conclusions.

Re:If the tree falls in the woods, no-one hears it

[SumoRoach]

You just described an exploit where the situation was *easy* to create and the poster was talking about a situation where the situation was hard to create.

Re:If the tree falls in the woods, no-one hears it

[Creepy Crawler]

There was the same obfusication in both. Timing based attacks are 'not cool' unless used in conjunction with other security measures.

In the most likelyhood, some idjit will think this is 'security' and secure a telnetd on a port. Then when they're hacked, oh-nos! Thats when they realize from the logs the attack came from within the ISP. Big surprise.

Anyways, I'd prefer to use standard queries for networks and not have everyting hidden... Having sshd running with no key-sharing is plenty secure enough for me (well, with obvious nsa-patches.. heh heh heh).

Yet another case of too many TLAs

[Mark of THE CITY]

I read ELF as "Extremely Low Frequency" and was thinking "how can a really slow clock lead to an exploit?" Then I read the bleeping header...

Re:Yet another case of too many TLAs

[Anonymous Coward]

Surely you mean YAC OTM TLA's ?

Re:Random one time bug

[RedLaggedTeut]

Yea, in fact I have come across "random one time bugs" that caused me "to shrug my shoulders" and most of the time they turned up again in the last days before I had to deliver the project, which I wasn't always succesful at.

Re:If the tree falls in the woods, no-one hears it

[Anonymous Coward]

You just described an exploit where the situation was *easy* to create

If you know the reason it worked in the first place, yes. If there is a one in a 5000 timing chance it will work and you don't know it, recreation becomes a bit more frustration

The user..

[Anonymous Coward]

" a malicious user "

Do we know the identity of this malicious user? If so, can't we just "fix" him? :)

Re:If the tree falls in the woods, no-one hears it

[Anonymous Coward]

You missed the point grasshopper. It's a comment on perception, not reality.

Re:If the tree falls in the woods, no-one hears it

[shaitand]

Arguably, the world would be a very different and much improved place if they did.

Re:If the tree falls in the woods, no-one hears it

[Mornelithe]

Well, I suppose all Christians would be blind and handless, so it's a start.