Critical Security Hole in Linux Wi-Fi

thisispurefud writes "A flaw has been found in a major Linux Wi-Fi driver that can allow an attacker to run malicious code and take control of a laptop, even when it is not on a Wi-Fi network."

Comments

Re:Patched!

[Ayal.Rosenthal]

My concern is that you are right - "so have most people that actually pay attention to security posts." The strong benefit of Linux vis-a-vis MSFT (and its not price) is that as an open system you have an nearly unlimited pool of the best computer code writing minds constantly updating and improving upon one another's kernel code around the world. But, if when errors are uncovered and corrections made, patches are only known to that pool of people then mass users will be exposed to significant security risk. The average Joe running Linux will suffer and that hurts the entire community in both reputation and user adoption rates.

Re:Complex Hack

[chord.wav]

The Windows being ease to use is not a mistake. It's a business decision. Even for their server products, they chose to go that way. And, if you ask me, they didn't do that bad, given the market share they have.

Not Overly Complex Hack

[LinuxGeek]

Humorous, but if someone wants a quick and painless route, check out Ubuntu. I running 7.04 beta on my laptop and wifi works well with my two very different APs in WPA(psk) mode. Installed and working, no tweaking, no manual compiling, no config file fiddling required. After running Linux for 12+ years I am quite happy with the state of Ubuntu.

Article Tagging: "haha"????

[Anonymous Coward]

Why is a tagging keyword 'haha'?

Re:There's more to the world than Microsoft.

[TheRaven64]

The biggest problem with this kind of thing is not the operating system security model, it's the hardware. A device in most consumer machines can issue DMA requests that allow it to read or write arbitrary addresses in physical memory. No matter how isolated the driver is, the device itself can still poke at your memory. This can be addressed by adding an IOMMU, which allows the kernel to assign a virtual address range to the device, and prevents it from accessing random areas of memory. Once you have this, it's possible to isolate drivers more and impose a good security model on them, but without it, anything you do is a bit pointless.

The good news is that the rise of virtualisation means that IOMMUs are going to become a lot more common in the next few years.

Here's an idea:

[The Cisco Kid]

Get rid of wifi cards (PCI as well as PCMCIA), and instead implement the wifi 'client' side with an ETHERNET jack to connect .. well, anything that has or can have an ethernet port. Have a 'router' build in that is accesible and configurable via HTTP and/or telnet. Include a 'bridge mode' where, once configured, the router steps out of the way for cases where you are on a known network where you trust its security, or for 'public' untrusted networks you leave the build-in router enabled, isolating you from unexpected inbound connections.

Then, you dont need specific 'drivers' for wifi hardware (you just need to support ethernet)

Re:Fixed! -not!

[quixote9]

Um, "Joe Linux" here, chiming in. I run Fedora, which was pre-installed on oddball hardware. If Fedora has automatic updates like Ubuntu, and if they just work, I sure as hell haven't heard about them. The Fedora repository is about 10% of the way to useful. 15%, when I'm feeling charitable. I'm on Core 3 because I haven't found a distro that can deal with my system, and, since I'm a biology geek not a computer geek, I have no idea what to do or the time to spend finding out.

It gets worse. I don't even know if I'm running a madwifi driver or not. I looked at the running processes, but there's nothing obvious there. I don't know if madwifi is called something else in the process list. I do know I have a Atheros chip.

The point I'm trying to make is more than just displaying ignorance. The point is that it may be hard for those of you who are close to the subject to realize just how opaque it is to those of us who aren't. If you're in the know, share their knowledge. It's kind of frustrating, from my perspective, to hear, "It's all automatic, and if it's not, you're just too hopeless to deal with."

(All that said, you're quite right that when updates are applied automatically and effectively, both the clueless and the clued benefit. That's why I'm getting my next system with Ubuntu on it!)

Apply the same consideration

[Durzel]

If this was a Microsoft flaw there wouldn't be any talk of "good PR" in releasing a patch quickly, or any other positive angle. There would be reply after reply about Microsofts' code being bloated, the evils of closed-source, monopolistic tactics, that one time when Bill Gates stood on a cats tail by mistake, etc. Linux isn't the only golden boy, Firefox (vs IE), Google (vs big nasty corporations), etc get just as much ridiculously transparent partisan treatment.

Vulnerabilities, particularly serious ones, are never good news. At the very least it would cost businesses who have deployed Linux engineer time in fixing (applying patch(es)) the problem, it generates uncertainty in the market - it creates the potential for business managers who just scan the IT news pages to say "didn't Linux have that serious problem not long ago?". This much is true of any OS, particularly one that businesses need to rely on.

I'm a firm believer in open-source, and I use both Windows and Linux in equal measure both at work and at home. I don't however believe fundamentally that the fact Windows and IE are closed-source automatically make them "poorly written". As has already been remarked a lot of this comes down to usage statistics... with a 90%+ market share you can guarantee that every hacker out there is trying to find fault in every single DLL that Windows ships with. As Linux gains more traction in the desktop & server markets as time goes on you can be sure that there will be most vulnerabilities like this being found. Programmers make mistakes, and there is no such thing as bug-free software.

I really wish Slashdot could dispense with the hidden agendas, partisan attitudes and blatent fanboyism and not sweep serious vulnerabilities like this under the carpet as if they aren't a big deal. Dimissing them as trivial is - if anything - more damaging than giving them the proper attention.

Re:patched already

[Bretai]

a small open-source Linux compatibility shim around the actual, binary only driver.

So the binary HAL layer is less than half of my driver and doesn't include frame parsing and generation or rate control, yet you'd like to call it a small compatibility shim? I'd say the driver is mostly open source.

As for the effort to reverse engineer the HAL, I think the chip versions are revised too quickly for that to be widely successful. Seems like a lot of work for little return.

Re:patched already

[FauxPasIII]

> So the binary HAL layer is less than half of my driver


root@Callooh ~ =) # lsmod | grep ^ath
ath_rate_sample 11776 1
ath_pci 87456 0
ath_hal 189584 3 ath_rate_sample,ath_pci
root@Callooh ~ =) #


-shrug- No disrespect. I like, use and recommend to others your driver. It's by far the most complete of the many wireless ethernet drivers I've used with Linux.

Granted, when there's a fully free-software driver that will run my card, even if it isn't as complete, I'll be switching to it. But I hope you don't take that as an attempt to diminish the extremely valuable work you do.

Re:madwifi links.

[Bretai]

you can type, "lsmod | grep ath_pci" to find out if you are running the supposedly exploited module

You can also type "modinfo ath_pci | grep version" to find which version you have.

The patched driver is 0.9.2.1 or newer.