Torvalds Creates Patch for Cross-Platform Virus

Newsforge is reporting that Linus Torvalds took a few minutes to review the cross-platform proof of concept virus covered yesterday and has proven that the virus does indeed not work with latest kernel version 2.6.16 and even released a patch in order to fix this "problem." From the article: "The reason that the virus is not propagating itself in the latest kernel versions is due to a bug in how GCC handles specific registers in a particular system call. [...] So the virus did a number of strange things to make this show up, but on the other hand the kernel does try to avoid touching user registers, even if we've never really _guaranteed_ that. So the 2.6.16 effect is a mis-feature, even if a _normal_ app would never care. It just happened to bite the infection logic of your virus thing."

Comments

This is what we call geeks

[microbee]

:)

Fix it?

[gnuadam]

I think you misunderstand. He fixed a flaw in the kernel that kept the virus from *working*. The patched systems should be vulnerable.

Re:Fix it?

[FhnuZoag]

Well, one more step towards making Linux ready for the desktop.

Does this mean...

[RealBothersome]

...that linux was patched so that the virus would now function as expected? I'd hate to think we left any program behind.

Re:Does this mean...

[Anakron]

Yes. The kernel patch works around a bug in gcc. The patched systems are now *vulnerable*

Re:one-man army

[rbochan]

what prevents each member of a programming group from having "complete mastery" of the kernel?

2 words:

middle management

The Microsoft equivalent?

[Foofoobar]

Ok... now lets see Bill Gates issue his own patch. The clocks ticking Bill. :)

Incorrect title

[cperciva]

Linus did not create a patch for the virus. Linus created a patch for the Linux kernel, to fix a bug which happened to have been discovered by looking at the virus.

Of course, if the story had been submitted with the correct title of "Linus fixes bug in Linux", it probably would never have been posted.

Re:Incorrect title

[Anonymous Coward]

Sorry, it was not a bug in the kernel either. A correct title would be "Linus patches kernel with workaround for GCC bug uncovered by cross platform virus". RTFA next time smartass, MMmmmkay?

This is EXACTLY why I run NetBSD

[Anonymous Coward]

I don't want to get enfected with any of them Windows viruses, Mac Worms, or Linux Diseases.
So I run NetBSD
On a VAX

I'm slow, but I'm not infected.
(that's what I tell my girl also)

Re:Only 16 comments?!

[AnalystX]

Some of the "fanboys" are applying the new patch, and the rest are looking at the contents of your hard drive right now.

Best part

[slashflood]

from TFA:

This lends support to the speculation that this virus is not new code at all, in spite of how Kaspersky Lab is trying to use it to drum up new business. [...] And shame on the anti-viral industry, Kaspersky Lab in particular, for its attempts to deceive the public by passing off old code as something new.

More on Linus + virus

[caffeination]

From Newsforge

We sent an email to Linus Torvalds to let him know about our testing. He replied:

That said, it sounds like it's a regular program that just happens to work on both Windows and Linux, and that happens to do things that are perfectly OK per se (i.e. writing to files that are owned by the user). So it's interesting just because of the "works on both Linux and Windows" angle, not because of any viral nature.

This is a really good insight, I think. While the rest of us are thinking about the "virus" and wondering what it means for the future, Linus identifies all these ignored technical aspects.

The power of a mind untouched by Slashdot?

My answer

[EmbeddedJanitor]

Performance is only a small part of the issue. You have to look at the TCO of running viruses to appreciate Windows properly. With Linux it is far harder to run a virus and you've got to train all your users to chmod etc. With Windows it's much eaiser, just double click or drag and drop. Now that saves you a bundle in IT tech support when people ask "how do I install virus X on my PC. Further, with Windows you get a lot more choice. You can get a wide selection of popular viruses from easy to download sources. Linux is pretty short on choice, so if you switch to Linux you're limiting choice which is UnAmerican.

Re:Bug Virus?

[after fallout]

AFIAK, there is no actual exploit in the code provided. The virus only does things that a regular program should be able to do, given the correct permissions.

The virus, written in assembly, calls the kernel via a depreciated interface (int 0x80 instead of syscall). It happens to have a value in the ebx register that it needs after the (buggy) system call.

The bug in the kernel is due to the fact that gcc assumes the system call doesn't change user registers (which the kernel isn't suppossed to as a policy) so gcc forms code to make the system call in less time (less instructions, less overhead) by not caring about user registers. The fix for the bug simply restores the value of the ebx register to what it was before the system call, hence the bug now works (as it has the correct value in the ebx register).

Re:Bug Virus?

[Harik]

You do realize that the virus wasn't calling the explot_to_gain_root() syscall, right? It was doing file I/O to a specific file that it had already opened and gained access to. And that failed, because of a GCC bug that caused the kernel to tromp on the userspace registers.

In fact, it would bite any program doing direct syscalls rather then using libc, so it might break linux handwritten asm code as well.