Slashdot Mirror

← Back to Stories (view on slashdot.org)

Critical Security Hole in Linux Wi-Fi

Posted by CmdrTaco on from the nobody's-perfect dept.

thisispurefud writes "A flaw has been found in a major Linux Wi-Fi driver that can allow an attacker to run malicious code and take control of a laptop, even when it is not on a Wi-Fi network."

4 of 262 comments (clear)

  1. Not Overly Complex Hack by LinuxGeek · · Score: 3, Interesting

    Humorous, but if someone wants a quick and painless route, check out Ubuntu. I running 7.04 beta on my laptop and wifi works well with my two very different APs in WPA(psk) mode. Installed and working, no tweaking, no manual compiling, no config file fiddling required. After running Linux for 12+ years I am quite happy with the state of Ubuntu.

    --

    Kindness is the language which the deaf can hear and the blind can see. - Mark Twain
  2. Article Tagging: "haha"???? by Anonymous Coward · · Score: 3, Interesting

    Why is a tagging keyword 'haha'?

  3. Re:There's more to the world than Microsoft. by TheRaven64 · · Score: 4, Interesting
    The biggest problem with this kind of thing is not the operating system security model, it's the hardware. A device in most consumer machines can issue DMA requests that allow it to read or write arbitrary addresses in physical memory. No matter how isolated the driver is, the device itself can still poke at your memory. This can be addressed by adding an IOMMU, which allows the kernel to assign a virtual address range to the device, and prevents it from accessing random areas of memory. Once you have this, it's possible to isolate drivers more and impose a good security model on them, but without it, anything you do is a bit pointless.

    The good news is that the rise of virtualisation means that IOMMUs are going to become a lot more common in the next few years.

    --
    I am TheRaven on Soylent News
  4. Re:Fixed! -not! by quixote9 · · Score: 5, Interesting

    Um, "Joe Linux" here, chiming in. I run Fedora, which was pre-installed on oddball hardware. If Fedora has automatic updates like Ubuntu, and if they just work, I sure as hell haven't heard about them. The Fedora repository is about 10% of the way to useful. 15%, when I'm feeling charitable. I'm on Core 3 because I haven't found a distro that can deal with my system, and, since I'm a biology geek not a computer geek, I have no idea what to do or the time to spend finding out.

    It gets worse. I don't even know if I'm running a madwifi driver or not. I looked at the running processes, but there's nothing obvious there. I don't know if madwifi is called something else in the process list. I do know I have a Atheros chip.

    The point I'm trying to make is more than just displaying ignorance. The point is that it may be hard for those of you who are close to the subject to realize just how opaque it is to those of us who aren't. If you're in the know, share their knowledge. It's kind of frustrating, from my perspective, to hear, "It's all automatic, and if it's not, you're just too hopeless to deal with."

    (All that said, you're quite right that when updates are applied automatically and effectively, both the clueless and the clued benefit. That's why I'm getting my next system with Ubuntu on it!)