Local Privilege Escalation On All Linux Kernels

QuesarVII writes "Tavis Ormandy and Julien Tinnes have discovered a severe security flaw in all 2.4 and 2.6 kernels since 2001 on all architectures. 'Since it leads to the kernel executing code at NULL, the vulnerability is as trivial as it can get to exploit: an attacker can just put code in the first page that will get executed with kernel privileges.'"

Comments

pwned

[Anonymous Coward]

If this was Windows we'd never hear the end of it.

Now STFU.

Re:pwned

[Anonymous Coward]

If this were Windows, we'd first hear about it when our machines get owned by some malware, and then it would take months for a patch to be released. Since this is Linux, expect a fix in a week or less.

Re:pwned

[lukas84]

Expect a source fix with no regression testing in a week or less. Wait months for the big distribution makers (RedHat, Novell) to release it to the masses.

Expect people manually rebuilding their kernel in panic, having machines rendered unbootable because they decided the 250$ bucks for the iLO Advanced license wasn't worth it since Linux never crashes, etc. pp.

Face it: IT sucks. The OS matters little.

Re:pwned

[Bandman]

Ah, I miss 1999, too.

Seriously, have you used a Windows machine at all in the past, say, decade?

A _real_ Windows machine, not the crap they sell you at Best Buy. No? OK then.

Re:pwned

[MaskedSlacker]

Well by that logic 99% of windows users haven't used a real windows machine either.

Re:pwned

[gmuslera]

If this was Windows we'd never hear the beginning of it. How much local privilege escalation vulnerabilities normal windows users worry about? Are the remote vulnerabilities (and the ones that don't need to escalate, as run as the current user) the ones that get lots of publicity. And you got from time to time a number big enough of remote vulnerabilities there to consider them the only ones that matters.

Of course, if you add a local privilege escalation to a some app remote vulnerability that enables to run code, even if is with low privileges, there you have a potential remote root exploit. Is something to care about, but odds are low that a lot of systems will be affected.

Re:pwned

[calmofthestorm]

Yes, hardened windows is reasonably secure. After you spend an hour or two installing all the third party software and configuration settings you need to prevent being owned in under five minutes. Or you can just install Ubuntu.

And on ANY operating system, you need to accept that a user having local execution privs means that every now and then they'll have a chance to root you with a 0day. Whether it's weekly on Windows or monthly on Linux, 0days happen and there's nothing you can do about it.

Re:pwned

[Bandman]

Yeah, I know, I nearly cancelled the post after I wrote it.

Desktop Windows /is/ Windows, but Windows Servers are far more inherently secure than Windows Desktops, simply by the way that they're operated. It was a bad comment.

Re:pwned

[spun]

Mmmm, yeah, I'm gonna need you to look up the meaning 'local exploit,' mkay?

Re:pwned

[dword]

Of course we'd never hear the end of it, because we paid a shitload of money for a system that would be vulnerable for months until MS would decide to release a patch that wouldn't conflict with the rest of the bloat. That wasn't always the case, but it's what happened most of the time when Windows (as an operating system) got pwned with an exploit like this. There are still tons of unpatched Windows computers infected with Blaster... as long as you still hear about Blaster, you'll still hear about the vulnerability. That's why you'd never hear the end of it.

Re:pwned

[Real1tyCzech]

The flaw has been around since 2001.

There goes your theory. ;)

Re:pwned

[alexborges]

Really?

It normally takes redhat no more than 48 hours after the patch to send the kernel rpm through RHN.

Re:pwned

[AigariusDebian]

I'd rather expect a patch within 4 hours (cutting functionality) and a real fix within 24-48 hours and then I would expect most big distributions to have fixed packages out in less than 5 days (linux kernel takes a while to compile). More rapid distros might even have two fixes - a fast fix within 24 hours and a real fix in less than a week after that.

Re:pwned

[lukas84]

What's your point?

Re:pwned

[dword]

Replying to myself, with additional information for the OP: And how long have we heard about this? We're already so used to Windows exploits that we don't even care much about them...

Re:pwned

[AigariusDebian]

And if any of us would have read the article before posting we would know that a typical one-line fix is right there in the article and has been commited into the kernel mainline yesterday.

Re:pwned

[amicusNYCL]

Aw, cheer up little guy. I thought it was a very nice comment.

Re:pwned

[amicusNYCL]

Yes, hardened windows is reasonably secure. After you spend an hour or two installing all the third party software and configuration settings you need to prevent being owned in under five minutes. Or you can just install Ubuntu.

Yes, Ubuntu. Which apparently you don't need to configure at all to get owned.

Seriously, in a story about how trivial it is to get code to execute as root you post a comment about how much more secure Ubuntu is than hardened Windows?

Re:pwned

[amicusNYCL]

Buzz off, little worker bee, its simply not the case: this happens once every, say, couple to four years in Linux. Microsoft has one of this bugs every couple of sundays.

Citation needed.

Re:pwned

[Stupendoussteve]

Or you can just install Ubuntu.

According to TFA, apparently not.

Re:pwned

[calmofthestorm]

Um...are you referring to a physical attack? No unencrypted machine is even remotely resistant to that.

This particular vulnerability probably affects ubuntu (depending on the mmap status; certain default settings can actually prevent this), but I'm speaking generally.

Re:pwned

[tolan-b]

Oh, you mean like this UAC flaw that allows any user to gain 'root' which Microsoft in their infinite wisdom has decided isn't a security flaw and have *completely refused to fix*. Despite the fact that you know, it allows anyone with a user account to get admin privileges.

Yeah great.

http://www.istartedsomething.com/20090130/uac-security-flaw-windows-7-beta-proof/

Re:pwned

[timepilot]

Committed to the mainline kernel != Available as an update to [CentOS|RedHat|Debian]

Re:pwned

[tolan-b]

Oops that's the wrong flaw, though it's also rather bad and MS are also refusing to fix it. Sec I'll find the right one.

Re:pwned

[tolan-b]

OK I was wrong, it's not a flaw to get root from an un-privileged account, but it does allow malicious code to completely bypass UAC for the default account, so UAC with Win7 default settings is completely broken out of the box, and it's also one MS say is by design and won't fix.

http://www.pretentiousname.com/misc/win7_uac_whitelist2.html

Re:pwned

[PitaBred]

If this was Windows, we'd have never heard of it in the first place. Forget the end of it. It would've been enshrined in some obtusely worded update.

Re:pwned

[Vu1turEMaN]

I wonder which is more secure....Windows Server 2003 fully patched but no configuration changes, or a fully patched XP with about 20 of the really troublesome services disabled.

Re:pwned

[Denihil]

XP imo. I know a thousand slashdotters are going to groan when i type this but....XP fully patched with self selected services running only is pretty....secure. And runs your crap without complaints.

Re:pwned

[Anonymous Coward]

Thats funny, since this week my windows computer at work auto-updated and patched itself for 12 remote expoits/local exploits

Re:pwned

[alexborges]

Well configured linux boxes are plain impervious to attack.

See? I can do it too.

Re:pwned

[gad_zuki!]

So wait, the "exploit" is to run untrusted code as admin? That is not a privilege escalation attack. How is this different than running any malicious code?

Re:pwned

[alexborges]

Well its not trivial. This is not a remote exploit, its local.

Re:pwned

[alexborges]

You can find them in microsoft's "security" site.

Re:pwned

[Runaway1956]

Well - I'm searching for Linux botnets that have been created by this exploit. Searching . . . searching . . . searching . . .

Dang, I'm not finding any.

How about Windows botnets? WOW, will you just look at all of them? http://www.secureworks.com/research/threats/topbotnets/

I sure wish Linux would get off their dead arses and patch this problem. Sure would be nice if they can get it done in less than a month or six, like Windows!! Oh - wait - what? Linus committed a patch correcting this issue on 13th August 2009.

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98

I guess I'll hold off on pushing the panic button. I see no need to "upgrade" to Windoze, LMAO

Re:pwned

[Anonymous Coward]

Good luck, the GP is pretty clearly your run-of-the-mill M$ hater. I almost wonder if alexborges is another twitter puppet.

Re:pwned

[Denihil]

Too bad that a well config'd lin box wasn't a option. Nice try though!

Re:pwned

[jim_v2000]

A common defensive technique. X isn't the REAL X, so it doesn't count!

Re:pwned

[amicusNYCL]

That's right. It's a trivial local exploit. Those aren't mutually exclusive.

Re:pwned

[alexborges]

How trivial is it to get into a linux box and why would that be the os's fault?

The fact is that local exploits are much less severe than remote exploits.

Its an ugly bug, sure, but most oses out there are much worse.

Re:pwned

[amicusNYCL]

Surely you can link to a few examples of privilege escalation exploits for Windows coming out every two Sundays. I mean, we've had a lot of Sundays since Windows has been out.

Re:pwned

[alexborges]

No no, not run-of-the-mill: ive hated microsoft for a big while and still find it very, very fun to let people know how this company could'nt care less for the security of their customer's information.

I like to talk about it specially since MS has contracted some good PR firms to come into slashdot to attempt some trolling that is always easy to spot.

Re:pwned

[alexborges]

Ah...

We are now that picky.... its a figure of speech. Change that to MUCH MORE OFTEN THAN THE LINUX KERNEL, go to secunia: you do the math.

Re:pwned

[Tacvek]

Modern windows has many levels of "admin".

But let us say that the admin accounts are are now by design almost the same as regular user accounts. By default they should not be able to harm the system. If you deliberately elevate an application to full rights (equivalent to using sudo to run the program) then it can do anything.

The problem here is that an unelevated application can just inject code directly into the memory space of certain other unelevated applications which can elevate themselves at will without user interaction.

This is a broken design. It is equivalent to having some normal applications that can just call setuid(0) and be granted full root rights without any user input, and then having a way for other normal applications to span a new thread in the other process running arbitrary code.

Re:pwned

[Anonymous Coward]

Yes, it's always easy to spot something you are sure is there, especially when you are determined to find it.

Do you have any idea how crazy you sound? PR firms that come to /. to troll on behalf of Microsoft that only you can see, so you spend post after post trying to enlighten the masses?

Let it go.

Re:pwned

[Jerry]

In a week or less?

Linus already patched it.
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98

He wrote it at 8:28AM and committed it at 10:57AM this morning. Expect to see it in your repositories tomorrow, if not sooner.

Re:pwned

[alexborges]

I dont care how crazy do I sound. Hell, do you even know the FOSS community?

BTL publicity online is a common practice this days. Whats so odd about it?

Re:pwned

[WheelDweller]

What are you talking about? We hear about these all the time! Like stories where dogs bite people, it's just not news anymore.

It's, sure, granted, BORING that it's just another local-only problem (most Linux ones are: if you have access to the machine, you can do anything you want, anyway.) Windows has these, remotely available all the time.

NOW WHERE THE DIFFERENCE LIES...

Linux will patch this bug, and it's improvement will be carried on to the next revision. Windows hacks out and adds new all the time: a problem there is *always* likely.

Isn't it clear by now? Where ELSE do you go buy something, then buy a component of the competitor, just to make sure it gets through the day? Microsoft people know you get an AV program, or you'll have to reload.

Windows is a very fragile product, it has been for two decades, and it shows no signs of changing any time soon. I've been in the marketplace since 1978; this whole thing is just so clear.

Re:pwned

[Anonymous Coward]

Yea Linux has been worked on FOREEVER it should be secure by now. Sheesh!

Re:pwned

[Anonymous Coward]

This is the windows newbs one chance to stick it to the Unix guys, don't fuck this day up for them!

Re:pwned

[toadlife]

You were the one who made the original claim. Methinks it's you that should go to secunia and do the math.

Re:pwned

[amicusNYCL]

Possibly, for sufficiently loose definitions of "much more".

Linux kernel 2.0-2.6: 279 Secunia advisories, 473 vulnerabilities

Windows 2000 Server + Windows Server 2003 Standard + Windows Server 2008: 472 Secunia advisories, 580 vulnerabilities

It's also worth noting that kernel 2.6 alone contains 186 advisories for 352 vulnerabilities with 6% unpatched. Windows Server 2008 contains 40 advisories for 82 vulnerabilities with 0% unpatched.

So there's the math. Keep in mind that's comparing an entire server OS with just the Linux kernel.

We are now that picky...

This is Slashdot. We've always been that picky.

Re:pwned

[vtcodger]

***Well its not trivial. This is not a remote exploit, its local.***

True -- as formulated and presented. But what would you like to bet that there are roughly 200 clever but warped people out there working on ways to exploit the defect remotely? 150 for the publicity or because they are curious. And 50 for profit. What do you reckon that one or more will succeed? Even money maybe? (... Let's see ... we log in via anonymous ftp, then we do x and y and z and -- viola -- now we are root and running telnet ...)

Of course, Windows seems to get a bunch of patches every month for stuff of probably comparable severity, so this is probably not a reason to switch. Does make me wonder if computers with sensitive data ought to be networked quite as freely as we are doing today.

Re:pwned

[jcr]

A _real_ Windows machine,

What, an IBM PC-AT? Nope, can't say I have.

You didn't seriously try to use the "no true Scotsman" fallacy to defend Microsoft, did you?

-jcr

Re:pwned

[alexborges]

If they take more than a week, then all their work will be for nothing. Patch is in main kernel as of today and yes, linux servers are generaly easy to update.

Re:pwned

[arndawg]

Parent is not a troll. Local Exploit still means a bug in firefox can leave your box totally "PWND!" A local exploit is more dangerous for a desktop computer than a server. but is still a very real concern.

Re:pwned

[alexborges]

Thats what I get for sending you to do the math. Im still too lazy to go check it out and look at methods, years and the rest.

||sarcasm|| I take your analysis as true and hereby declare that windows has been exploited lesser than linux, has less malware against and is inherently less prone to attack than linux or turning into a braindead spamzombie than linux. ||end sarcasm||

Happy?

Re:pwned

[Anonymous Coward]

Nothing is odd about BTL advertising except for the fact that you are absolutely sure it's going on and apparently only you are clever enough to spot it.

Re:pwned

[Dragonslicer]

Windows Servers are far more inherently secure than Windows Desktops, simply by the way that they're operated.

Wait, what?

Re:pwned

[tolan-b]

I know it's not privilege escalattion per-se which is why I said "I was wrong". But UAC is Microsoft's answer to running as a non privileged user for the average end user, the default user is an admin. The user has root privileges, but apps they run arent meant to, so the effect is meant to be like running as a regular user on *nix OS and using sudo. So the effect here is that essentially, from a malware having root privs point of view Win7 is no better than XP was, but now you have to put up with lots of password prompts that dont actually give you any added security. But hey, it's by design.

Re:pwned

[Jean-Luc Picard]

True, but its the first step

Re:pwned

[magarity]

How much local privilege escalation vulnerabilities normal windows users worry about?
 
They probably don't worry about it at all because the vast majority of Windows users log in and run with an administrative level account in the first place.

Re:pwned

[TCM]

Seriously, what's your point? That you cannot gain local privileges other than logging in? You are really really naive.

Re:pwned

[peragrin]

No but that means the updates are being tested, which then pushes out to the distro's which test for compatibility, which release to end users, We are already into day 2 of a 5-6 day system.

Re:pwned

[master5o1]

Yeah, he should have complained about the missing opt-- oh wait, it's not a slashdot poll.

Re:pwned

[petermgreen]

Linux isn't much better, if I have code running under your user account I can change your menus and your path. Then next time you use su/sudo/the "root terminal" menu entry I get root.

The whole principle of a user having low permissions and then under that low permission environment doing something to gain higher permissions is fundamentally insecure.

Re:pwned

[beav007]

Of course, as this only affects 2.4 and 2.6, users of Debian stable should have no reason to worry.

See? All that testing is worth it after all!

Re:pwned

[atmurray]

Is this post modded "Interesting" because of it's unique interpretation of English grammar?

Re:pwned

[Anonymous Coward]

Why did you include 2.0 kernels in those figures, 2.2.0 was released in 1999. You also compared the 2.6 kernel to Windows Server 2008, where 2.6.0 was released in December 2003. Though it is interesting that there are unpatched vulnerabilities in the 2.6 kernel and Windows Server 2008 has none unpatched.

Re:pwned

[shutdown -p now]

Mmmm, yeah, I'm gonna need you to look up the meaning 'local exploit,' mkay?

A local privilege escalation exploit means that you no longer need a remote root exploit - anything that lets you execute code under any account will do. In practice, this can often be just as dangerous.

Re:pwned

[gmuslera]

Once the title starts with pwned, you worry about english grammar?

Re:pwned

[Anonymous Coward]

Linux will patch this bug

Now THAT is something I'd pay to see.

I've been in the marketplace since 1978

Which is only proof that some people need a big headstart.

Re:pwned

[Nefarious Wheel]

(Sigh) I miss KESU and the constrained addressibility of ring-fenced instruction sets. Oh, VMS, Oh my heart!

Re:pwned

[Bandman]

No *true* scotsman would use a Windows machine without an NT kernel.

Re:pwned

[Runaway1956]

That's "Mister Asshole" to you, sonny.

BTW, have you ever thought what life would be like if you had no asshole? Things would get quite miserable, very quickly. People really should show their gratitude. Have you kissed an asshole today? Well - to be fair, kissing assholes is best done in pairs. Try this command in Linux, my young friend:

Manpage -date

NAME

date - get and print a date
SYNOPSIS

date [-s] [-local] [-k] [-blind] option=value...
DESCRIPTION

If no arguments are given, a date will be selected at random. Providing an argument will restrict the search pool of dates. Hopefully these arguments will not carry forward into the actual date. Only the superuser can select dates by name.

The -s option registers you in the date database and (if not -local) posts your vitals to alt.personals (and, optionally, alt.sex.wanted).

Using the -k option selects a date, but does not make any further arrangments.

Ranges are specified with parentheses and brackets: (18,25) is 18 to 25 exclusive while [18,25] is 18 to 25 inclusive. An array of selections is given with braces such as "{blonde, brunette, redhead}". Multiple responses are separated with commas, as in "sex=female,yes,please".

-blind To arrange a blind date.

view[=must]

View prospective date's picture. To locate a picture, date searches several picture databases, including FaceSaver (uunet.uu.net) alt.sec.pictures, alt.binaries.pictures.erotica, and several FTP gif archives. You must have access to the Internet for FTP to work.

If view=must is set, and date is unable to find a picture, a request will be automaticly posted to alt.binaries.pictures.d asking for one.

Options to xv(1) may follow "view" or be put in the environment parameter XV.

The following options restrict the search pool to those who have supplied the necessary information.

dim=range,range,range

height=range
Synonyms are also supported: midget, twerp, short, beanstalk, giant, basketball-player

weight=range
Synonyms: toothpic, feather, wide-load, blimp

age=range
Synonyms: juvenile, underage, thirty-nine, over-the-hill, {mom, dad}, {grandma, grandpa}

sex={male, female}[,{yes, no, maybe}][,opt sex(6) options]
If sex=yes and you are registering, your vitals are posted to alt.sex.wanted in addition to alt.personals.

race={white, black, native-american, ...}
Various slang terms are also supported.

marriage={flirting, noway, maybe, once, twice, several}
Seriousness and experience.

kids={never, rightaway, oops, have, want}[,{one, two, three, four, bunch}]
Domestic leanings.

cooking={never, loveit, when_hungry}

color Synonym for race.

religion={Atheist, Moslem, Lutheran, Catholic, ...}

temper={mellow, quiet, hot-head}

interests={lists of possible interests}

name=lastname,firstname
Specify name of your date. Perfect for hitting on. Names can only be specified by super-user.
FILES

$HOME/.daterc
Optional place to store options, for frequent daters.

$HOME/.datehist
History of dates, to avoid duplication.

$HOME/.persona
Options describing yourself, if you haven't registered in the database. Note that the first time you use date and supply this information, you are registered in the blind-date database.

Re:pwned

[ResidntGeek]

You are an astoundingly stupid person.

I'm curious, is there anything that would have convinced you? Insight from people with experience in the area and hard data have both failed. What, precisely, IS your opinion based on?

Re:pwned

[Anonymous Coward]

Any particular reason you compared all of 2.6 against win2k8?

Windows 2008 has been out since 2008.

The 2.6 kernel has been out since 2003.

Re:pwned

[turbidostato]

"A common defensive technique. X isn't the REAL X, so it doesn't count!"

That's called the "no true scotsman" fallacy (http://en.wikipedia.org/wiki/No_true_Scotsman).

Re:pwned

[V!NCENT]

1) Ctrl+Alt+Del
2) Execute "explorer" (without the brackets)
3) Now that we run that 'root' (at least in XP rofl) we can see the password file
4) Copy to USB stick, floppy, whatever
5) Now you could go to your home, but Windows needs the Temp folder so you can just install the following there (Oh and if you need to be root then just go to the taskmanager (Ctrl+Alt+Del) and execute);
5) Download a standard CrackT3hW1nd0w5P455w0Rd app
6) Decrypt (yeah I am not kidding it's not even hashed lol xD)
7) Typ in the root password at the login screen
8) Rofl @ Microsoft

But I see that Linux has an exploit. Well it's a bit of a catch22, isn't it? You want to haxxors my Linux, but in order to run the exploit you have to have haxxored into my Linux first. Have a nice day :')

Re:pwned

[amicusNYCL]

My opinion? What opinion is that? Let's see what I've said...

Citation needed.

Surely you can link to a few examples of privilege escalation exploits for Windows coming out every two Sundays. I mean, we've had a lot of Sundays since Windows has been out.

Possibly, for sufficiently loose definitions of "much more".

Linux kernel 2.0-2.6: 279 Secunia advisories, 473 vulnerabilities

Windows 2000 Server + Windows Server 2003 Standard + Windows Server 2008: 472 Secunia advisories, 580 vulnerabilities

It's also worth noting that kernel 2.6 alone contains 186 advisories for 352 vulnerabilities with 6% unpatched. Windows Server 2008 contains 40 advisories for 82 vulnerabilities with 0% unpatched.

So there's the math. Keep in mind that's comparing an entire server OS with just the Linux kernel.

I ask the guy to back up his claims, and I quote statistics from Secunia after being asked to do so. Which part of that has my opinion in it? Why don't you tell me what my opinion is, you know so much? Did I state an opinion and strike a nerve without realizing it?

Re:pwned

[amicusNYCL]

I guess if you're going to admit defeat in our stupid little argument, that makes me a little bit happy. At least for as long as it takes to type this, anyway.

I never even stated a position, I only asked you to back up your claims and quoted some statistics, but if you want to concede to someone without a position then I guess I'll take it.

Re:pwned

[amicusNYCL]

Why did you include 2.0 kernels in those figures, 2.2.0 was released in 1999.

2.0 only had 1 advisory and no vulnerabilities, it could have been left out and the numbers wouldn't have changed. 2.6 actually turned out to be the major offender.

Re:pwned

[amicusNYCL]

Sorry, next time I'll use 2.8 instead. Or, if you want to get Secunia to track 2.6.30.4, or any other minor version, I'll be happy to look that up also. But they don't track that.

Re:pwned

[dna_(c)(tm)(r)]

||doublesarcasm||You finally got the facts then.||doublesarcasm||

Re:pwned

[dna_(c)(tm)(r)]

XP Home Edition, Unpatched 12% (27 of 229 Secunia advisories), Most Critical Unpatched: Moderately critical.

Ubuntu 9.04, Unpatched 0% (0 of 50 Secunia advisories).

Keep in mind that Ubuntu is also affected by standard apps like OpenOffice.org, Firefox etc. If you're going to pick server versions to prove a point...

Re:pwned

[Anonymous Coward]

Of course not- Windows may not have "real" memory protection, but it has sanity checks to prevent code execution at NULL.

Re:pwned

[Errtu76]

Seriously, in a story about how trivial it is to get code to execute as root you post a comment about how much more secure Ubuntu is than hardened Windows?

Yeah, please stay on-topic like the rest of us.

Re:pwned

[John Betonschaar]

Maybe they'res a lot more vulnerabilities found in *every version of the linux kernel since 2.0* because *anyone can see the code*? Just guessing...

Vulnerability statistics are completely useless as a measure of OS safety. The only sensible measure would be the number of machines actually affected and being exploited, and the severity and real-world impact of said exploits. But these would be hard to quantify...

Anyway I'm pretty confident that even after correcting for the number of installations world-wide, a Linux box is much, much, MUCH less likely to be exploited than a Windows machine, whatever the reasons. If I interpolate the occasions that I ran into a rooted linux box (0 times) compared to an exploited Windows box (lost track looooong ago), then Windows seems to be infinitely more exploitable than Linux (or OS X, for that matter).

Re:pwned

[maxwell demon]

But it wasn't a real "no true scotsman" fallacy. After all, it didn't involve a scotsman. :-)

Re:pwned

[maxwell demon]

Indeed even encrypted machines are pretty vulnerable to physical DoS attacks.

Re:pwned

[maxwell demon]

You just have to break into a Windows computer which has access to a drive shared with Linux with home directories on it, put your exploit code onto some Linux home directory and modify .bashrc to run it. Then the next time that user starts a shell on the Linux computer, the Linux computer is owned.

Re:pwned

[maxwell demon]

Since remote userland arbitrary-code-execution vulnerabilities are useful for malware writers even without a root exploit, there's a chance that this exploit already has been found by them.

Re:pwned

[ThaReetLad]

Hmm. What if someone actually cares about security and didn't give you an admin account on XP? So far you've demonstrated a successful hack against your own PC.

*golf clap*

Re:pwned

[ChienAndalu]

Be careful when comparing Linux and Windows

Kernel 2.0, which I wouldn't pitch as a secure software product anyways, was introduced in 1997. Windows 2000 Server on the other hand was introduced three years later.

It is also worth noting that Kernel 2.6 was introduced in 2004 and Windows Server 2008 four years later.

Re:pwned

[kelnos]

Speaking of reading the article, the flaw isn't even *that* bad, especially for people mainly worried about servers. The article notes that support for various little-used network protocols must be compiled into the kernel for this exploit to work, such as IPX, Appletalk, Bluetooth networking, IrDA, or SCTP on IPv6. I bet many desktops have Bluetooth networking support enabled, however, though it's possible it's as an unloaded module.

Not saying it's not a big deal at all, but the number of affected systems should be much lower with this requirement.

Re:pwned

[Ginger Unicorn]

How is this insightful? The GP is talking about time from when the bug is discovered, and the manner in which it is discovered. The fact that the bug has been there from 2001 is totally irrelevant. There are likely to be more than a handful of undiscovered ancient bugs in the kernels of any OS you might mention. There's not a lot anyone can do about something they aren't aware of. I'm sure the post is likely a joke - it's the stupid mod I'm complaining about.

Re:pwned

[Net_fiend]

It may be patched, but if someone used the flaw around the time it was originally created (2001) then that is an awful long time for someone to have created another method into the machine after they've gotten in. Ever read The Cuckoo's Egg? Simply put if a hacker got into a system you'd think the first thing they do after escalating their privileges is to create a backdoor in case the one they came in was closed. Now...try to find that backdoor and any other apps the hacker put on the system. 8 years of residing on a system is a looong time, assuming they weren't found out beforehand.

Re:pwned

[Anonymous Coward]

Would a true scotsman take offense upon hearing that wasn't a real "no true scotsman" fallacy simply because it doesn't involve a scotsman? And would he take no offense if it doesn't involve someone who isn't a true scotsman. p.s. No true slashdotter would post anonymously.

Re:pwned

[0xygen]

Did I miss the joke?

Windows Servers are likely to be operated by server operators, who on average have (a little) more of a clue than Joe Bloggs.
Joe boots up Vista, turns off UAC, logs on as an administrator and installs Bonzi Buddy and anything IE asks him to.

It really does not say anything about the operating systems though... considering Windows 7 and Windows Server 2008 are pretty much the same thing under the hood, the only real difference is default permissions and running services.

Part of the very nature of Linux and BSD often being more secure is that the operators understand the system and the best practises on how to configure the system.

Re:pwned

[Anonymous Coward]

Yeah, it would have been much better if it hadn't been found at all. Right?

By your "logic", actually it would.

By the way, your trolling lacks precision: The exploit hasn't been around since 2001. (Please produce an exploit from 2001 if you can.) The bug has. There's a difference. Are you capable of understanding the difference, or are you too busy reveling in the bug's mere existence in order for your normal thought processes to kick in?

Try harder next time, youngling.

Re:pwned

[Anonymous Coward]

More importantly, some people are so used to them that they actively pretend they don't exist.

Re:pwned

[Gulthek]

The key funny word is "inherently". So the sentence can be parsed as:

"Windows Servers have more security built into them than Windows Desktops because of how they are operated."

Hee.

Re:pwned

[hesaigo999ca]

True enough, but that would be because, you would have to wait for 2 years before getting a patch.....
let's see how long it takes before the next kernel patch on linux....

3.....2.....1..... (signal)

ps- Also, trying to compare the reasons behind linux not getting flack is that linux is free, but you actually PAY for windows, so of course when you get a bug, you expect it to be taken care of immediately, where as something that
is free, well seeing as the patches come out almost the very next day, you could say that for some volunteers, THAT IS PRETTY DAMN GOOD TIME!

Re:pwned

[0xygen]

Inherent is fine... it means as a natural consequence of. Desktops are naturally operated by lusers, servers are naturally operated by trained operators.

I think someone is confusing "inherently" with "intrinsically"?

Re:pwned

[Anonymous Coward]

Yes. I have. I do regularly. It still sucks. Next.

Re:pwned

[Dragonslicer]

According to dictionary.com, the only definition that says "natural consequence of" is from a medical dictionary. The normal English definition is existing in someone or something as a permanent and inseparable element, quality, or attribute. One of the definitions even lists "intrinsic" as a synonym.

Re:pwned

[Jawn98685]

Er..., no. If this was Windows, you'd never have heard of it, period. Until, that it is, MS got around to fixing it or an exploit in the wild got everyone's attention.

Re:pwned

[gad_zuki!]

>But UAC is Microsoft's answer to running as a non privileged user for the average end user, the default user is an admin

I disagree. UAC is a bandaid for those who dont want to run as user. If you want to run as user, guess what, run as user. Dont shoehorn the UAC into something its not and then criticize it for what it aint.

Re:pwned

[Vintermann]

I suppose you meant this:

http://www.merriam-webster.com/dictionary/voila

and not this

http://en.wikipedia.org/wiki/Viola

Re:pwned

[david_thornley]

Are those numbers actually comparable? Linux' source code is easily available, and so are its bug logs. If Windows source code were readily available, and Microsoft's bug tracking system opened to the public, what would we see? Would the good guys notice more vulnerabilities? Would we find that there's more vulnerabilities than we get advisories for?

Moreover, comparing Windows Server 2008 with Linux kernel 2.6 with raw numbers doesn't take into account time and exposure. There's been a lot more time for people to find vulnerabilities in 2.6.

Re:pwned

[Palshife]

All kidding aside, Debian stable uses 2.6 kernels. If you're running lenny, make sure you're safe.

Re:pwned

[clone53421]

No true Scotsman would.

Re:pwned

[ookaze]

I thought these nonsensical cherry-picking comparisons using Secunia or any other site that doesn't track Linux, were dead?
To show how stupid it was to make an argument with Secunia, and how you tried to make the number fulfill your agenda, I will use Secunia too :
Linux 2.0 : 1 Secunia advisory, 0 vulnerability
Linux 2.5 : 2 Secunia advisory, 0 vulnerability
I can be kind too :
Linux 2.2 : 8 Secunia advisory, 5 vulnerability

Seriously, this is nonsense.
And saying comparing an entire Windows OS with just the Linux kernel makes sense in theory, but not in the context of vulnerabilities, especially in privilege escalation context.
Especially since usually these are related to drivers in the Linux kernel, and Linus has far more of them than a basic Windows OS.

Re:pwned

[alexborges]

Kernel 2.0 and 2.2 are WAY older than windows 2000.

Your stats suck, linux is still king. Go do the math again.

Period.

Re:pwned

[amicusNYCL]

Between 2.0 and 2.2 there are a total of 9 advisories for 5 vulnerabilities. They don't make a lot of difference. I thought the numbers would frankly be more impressive for Linux if they covered the 5 previous versions instead of the 3 previous versions. If you want to leave out the 9/5 for those two versions, and we can probably also get rid of the 2 vulnerabilities for 2.5 since it's an odd version number anyway, then that leaves 268 advisories and 468 vulnerabilities between versions 2.4 and 2.6 alone.

Better?

FYI: I think Linux is a superior OS, and have not claimed otherwise.

Re:pwned

[amicusNYCL]

I haven't even stated my point, all I've done is quote stats. We all know how meaningful stats are. It might surprise you to know that I consider Linux the superior OS in many respects. Actually, pretty much every respect except usability.

Re:pwned

[amicusNYCL]

It is also worth noting that Kernel 2.6 was introduced in 2004 and Windows Server 2008 four years later.

I don't see how that would factor in. 2.6 and Windows Server 2008 are the most recent offerings of the competing camps, correct?

Re:pwned

[amicusNYCL]

Moreover, comparing Windows Server 2008 with Linux kernel 2.6 with raw numbers doesn't take into account time and exposure. There's been a lot more time for people to find vulnerabilities in 2.6.

That's true, and a valid point, but it also indicates that Microsoft OSs have become increasingly secure. (many of)The bugs in Server 2003, for example, are not in 2008.

Re:pwned

[t0rkm3]

Cool... Except after you did alll that work you'll find that the default Redhat and Ubuntu installations are not vulnerable as they set the mmap_min_addr value to 65536.

The kernel was exploitable, only if it was configured incorrectly. Still an exploit, but not as large a one as it would seem.

Re:pwned

[amicusNYCL]

I thought these nonsensical cherry-picking comparisons using Secunia or any other site that doesn't track Linux, were dead?

I hadn't heard that, let me see if Netcraft confirms it.

Linux 2.0 : 1 Secunia advisory, 0 vulnerability
Linux 2.5 : 2 Secunia advisory, 0 vulnerability
I can be kind too :
Linux 2.2 : 8 Secunia advisory, 5 vulnerability

People have been quick to point out that it wasn't a good comparison to include 2.0 or 2.2 because of how old they are. I frankly thought it would make the numbers for Linux look better if they covered 5 versions vs. 2 versions. 2.4 and 2.6 between them have 268 advisories for 468 vulnerabilities, I thought if I bumped that up a little to 279/473 and included 3 other versions it would be more kind to Linux. So that's where my agenda is.

I frankly find it funny that I asked a guy to back up his claims, quoted stats from Secunia (which he asked me to do, by the way), and now people assume I have an anti-Linux, pro-Microsoft agenda. That's not even remotely true, I haven't even stated my opinion on either OS (in this thread, before today, anyway). I've mentioned in a couple other replies today that I consider Linux to be the superior OS of the two, but people have become very defensive.

Re:pwned

[Anonymous Coward]

Clearly the amount of testing that went into those two and a half hours was on par with any commercial OS !

Re:pwned

[ResidntGeek]

I didn't respond to you, I responded to alexborges. That's why my post makes sense as a response to him, and not you. It's also why when you click "parent" from my post, you get his post.

Re:pwned

[ChienAndalu]

It factors in when comparing defects in a products total lifetime.

Re:pwned

[amicusNYCL]

Sorry, when the posts are nested this deeply it loses the formatting. I'm confusing myself now.

Re:pwned

[amicusNYCL]

That's correct, 2.6 has had more time to have its bugs exposed. That's about as good as this type of relatively meaningless comparison can get though. It doesn't look like bugs are tracked in the iterative versions, on Secunia anyway.

Re:pwned

[clone53421]

Sorry, when the posts are nested this deeply it loses the formatting. I'm confusing myself now.

That's why it's sometimes helpful to use the <quote> tag to indicate what you're replying to.

Re:pwned

[david_thornley]

How does it show that Microsoft OSs have become increasingly secure? Do you have figures for Server 2003's early years to compare with Server 2008? And some idea how he environment was different and how that would affect known vulnerabilities? (I'd hope that 2003 bugs would be gone from 2008, but I'd also expect that 2008 has new bugs. Changed software always does.)

I find it plausible that Microsoft has been improving their security; they are paying attention to it, after all. However, the numbers quoted are rather vague and don't obviously indicate much of anything.

Re:pwned

[V!NCENT]

Hmm. What if someone actually cares about security and didn't give you an admin account on XP? So far you've demonstrated a successful hack against your own PC.

The entire point is obtaining the admin password when logged in as a user *golf clap*.

That is why you have to go to the task manager to launch things (admin process). And that is why you have to install to the Temp folder because as a user you need to be able to write there (apps). *golf clap*

Next time: read first, comment later.

Then when you have the explorer file manager launched (with admin rights; we launched this from the task manager *golf clap*) we can read the encrypter password file.

Get the point?

Re:pwned

[bhtooefr]

Want to know the most flawed part of Windows security? Its users.

Both in number and in desire to run applications of their choosing.

Number, because malware writers in 2009 often do it either for the money (directly or indirectly,) or to create a botnet.

Desire to run applications of their choosing because of the dancing bunnies problem.

But, even if you do know how to avoid malware, unless you believe in disassembling every program you use, and studying the disassembly before running the program, and then running it in a machine hooked straight to another machine, both machines separate from your network and the internet, one machine running the malware, one running Wireshark, and reloading the OS, updates, and apps on both after every test run... the dancing bunnies problem is still a problem. The only reason that it's only a problem on Windows is... Windows is the biggest target by FAR. If Linux were a big target, you'd get dancing bunnies problems on Linux.

There are only three REAL solutions to the dancing bunnies problem.

1. Detect the payload - read: antivirus software
2. Require every single application that runs on the platform to go through that sandboxing and testing procedure - read: iPhone, and we all know how well that goes.
3. Be a small enough target that nobody makes dancing bunnies for your platform, be happy with being a niche platform.

#1 is what Windows users do, #2 is pretty bad for obvious reasons (and you can't provide an easily accessible developer mode, either, or the dancing bunnies problem will rear its ugly head yet again, by telling the user how to enter developer mode to install the dancing bunnies.) #3 is an acceptable option, but has its downfalls. Closed source driver support, anyone?

Re:pwned

[ThaReetLad]

What are you on about? Task Manager runs as the logged on user, not as admin.

Try this. From a limited XP user account check that you cannot access the private data of another user (C:\Documents and Settings\\...)

Do what you suggest (ctrl-alt-del) and get task manager, and then launch explorer. Note that you still not access the other users documents. This shows you are still running as a limited user.

Re:pwned

[V!NCENT]

What are you on about? Task Manager runs as the logged on user, not as admin.

Yeah right. That's why I can kill processes with it...

Try this. From a limited XP user account check that you cannot access the private data of another user (C:\Documents and Settings\\...)

*sigh* It's a root process, but disables that option for users. Hey how hard was that to comprehend? Jesus Christ, if it was a user process then how in hell could I possibly launch stuff as root? Yes some apps will tell you that you need admin rights because it uses a function that allows it to see what rights the account has at install for example.

Windows security is like an unbreakable gate that doesn't let anything into your property, yest for the most part your property is surrounded by 2 feet high bushes. In other words: a total joke.

Re:pwned

[jon3k]

...and then they remembered they're virtualizing all their servers, like everyone else at this point, and just logged into the [vmware|xen|kvm] console

Re:pwned

[jon3k]

I'll see your one local privilege escalation and raise you 6 remote code executions, two privilege elevations and a DoS (and thats just for August)

http://www.microsoft.com/technet/security/bulletin/ms09-aug.mspx

Re:pwned

[Urkki]

Well its not trivial. This is not a remote exploit, its local.

Trivial local exploit becomes trivial remote exploit, if the machine is running any insecure application reachable from the net, or just connecting to the net. A daemon running as non-root (as they usually do), a CGI script on a user's web page, a vulnerable http/ftp/irc/ntp/dhcp/whatever client connecting to a compromised server, shared disk accessible from a compromised other computer...

Unless the machine is a hardened server where only local use is doing administration,, and doing even that with security in mind, then a trivial local exploit often is a trivial remote exploit.

Re:pwned

[Anonymous Coward]

You can kill YOUR processes with it. You can't even see processes that belong to other users. (apart from a limited subset of system processes such as winlogon) You can't kill system processes, and you cannot damage the integrity of the system in any way that is different to running as an equivalent UNIX/linux user.

You CAN shutdown the computer as a locally logged on user, which will also end the other users sessions, but that's not an additional problem as you already have physical access to the machine, and if you have that then it's pretty much game over, regardless of what OS is on the machine. Pull the plug. Insert a live CD. Take an axe to the machine. Install a piece of keylogging hardware. If you have physical access, it's yours.

Look at the column in task manager's process tab called "user name". See how a bunch of process are running under the SYSTEM account, and some under LOCAL_SERVICE. Well task manager runs as the logged on user, and if that's a limited account, then your limited to controlling your own processes.

You can spout on about how windows security is a joke all you like, but all you've demonstrated so far is how little you actually know about it.

Re:pwned

[Real1tyCzech]

Meh...

Slashdot mods are notoriously ... interesting?

Some moderators (when they actually "get" the joke), will mod it insightful just to help the rep of the poster.

Nothing new, just what happens when you let random people moderate a forum.

Re:pwned

[V!NCENT]

You can kill YOUR processes with it.

OK that's enough. This is as far as I will even read your BS post. 'MY' processes?! In XP the graphics driver runs as ROOT. In Vista they made it a feature that for the first time it runs as a user. So how can I kill my graphics driver? You see... you don't know shit about computers, let alone Windows. Do you even know what's at it's core? Do you even know how Windows truely works within? And do you know why progress in Windows is so terribly slow? Do you know why with every new release Windows is getting slower and MS can't speed it up?

You probably don't know shit. I will gradly ignore your future BS. Have a nice life

Re:pwned

[ThaReetLad]

Clearly I know nothing about computers. I've only been writing software professionally on windows for 10 years, and VAX/VMS, Alpha/VMS and PDP11 before that, and fortran on DEC UNIX at university before that.

You cannot terminate the XP graphics driver as a limited user (You may be able to crash it, and that may be a genuine security bug, but that's a different matter). Get a copy of VMware and try it, like I have. You cannot uninstall it or update it or anything as a limited user. XP home lacks some of the more advanced access control features, so I wonder if this is what you're thinking of, but XP Pro is much more secure.

On ALL operating systems device I know of device drivers MUST run (at least in part) in the Kernel in order to access hardware. Even in Vista only part of the graphics drivers run in user mode. There is still a core driver which runs in kernel mode, just as there is for your web cam and everything else. In Linux these drivers usually have to be compiled as kernel modules.

Do I know how Windows truly works within? Well, I've not read the source code, but I have read Mark Russinovich's excellent Windows Internals book, and Pravat's Advanced Widows Debugging (awesome when you have device driver bugs to fix).

The question is, do YOU know anything about windows? You keep talking about ROOT, but Windows doesn't have an exact analogue to the ROOT user. You say MS can't speed windows up, but that's precisely what they've done with Windows 7. In many cases it's faster even than XP on the same hardware, and it scales much better to high end enterprise machines thanks to finer grained locking in the task scheduler and memory subsystems. There are major improvements to the GDI subsystem which should mean that an app stuck (or just going slow) in some paint code will no longer hang up all the other apps trying to paint to the screen.

Re:pwned

[tolan-b]

Well I can't speak for other Linuxes, it's a long time since I used Redhat/Fedora or Suse as a desktop, but Ubuntu doesn't have a root terminal entry in the menus. I can't think of any standard apps or 'control panels' that request root straight away any more, they mostly ask when you try to do a specific operation. Granted you could probably wrap a random app in a password prompt and most people would just type it in anyway. In the case of Win7 UAC the code can get root the moment it's run.

But overall I agree with you, the sudo arrangement isn't a great deal better.

Re:pwned

[V!NCENT]

Clearly I know nothing about computers. I've only been writing software professionally on windows for 10 years, and VAX/VMS, Alpha/VMS and PDP11 before that, and fortran on DEC UNIX at university before that.

I guess I am not going to ignore you after all. OK let's get it on...

You cannot terminate the XP graphics driver as a limited user (You may be able to crash it, and that may be a genuine security bug, but that's a different matter). Get a copy of VMware and try it, like I have. You cannot uninstall it or update it or anything as a limited user. XP home lacks some of the more advanced access control features, so I wonder if this is what you're thinking of, but XP Pro is much more secure.

No need for VM; I still have genuine, even, XP pro and have a user account still floating around. I can kill my ATI driver. Not that killing it has any value because even the latest version keeps giving me BSOD's.

On ALL operating systems device I know of device drivers MUST run (at least in part) in the Kernel in order to access hardware.

Not with open source X.org drivers. I've tried a GNU/Hurd LiveCD about a year ago...

Even in Vista only part of the graphics drivers run in user mode. There is still a core driver which runs in kernel mode, just as there is for your web cam and everything else.

Not everything else -> http://channel9.msdn.com/shows/Going+Deep/Rob-Short-and-kernel-team-Going-deep-inside-Windows-Vistas-kernel-architecture/

Do I know how Windows truly works within? Well, I've not read the source code, but I have read Mark Russinovich's excellent Windows Internals book, and Pravat's Advanced Widows Debugging (awesome when you have device driver bugs to fix).

Well me neither, but all you need to do is read the Wine documentation, coupled with interviews and other readings from (ex-)Microsoft employees. Windows 7 is now basically, in contrast to lies, lies and even more lies, except for the kernel; Windows 3.x+95+98+2000+XP+Vista = Windows 7. It's rediculous and unbelievable, yet still very true... Which is the reason why some very, very old Windows apps (like win98) can still run on Windows 7. They keep expanding and expanding on what they have and almost nothing gets rewritten, which is why each version of Windows is getting slower and slower.

The question is, do YOU know anything about windows? You keep talking about ROOT, but Windows doesn't have an exact analogue to the ROOT user.

Well there isn't really a ROOT account, which is what I was trying to say: When logged in as a user, one runs everything like one would as an admin, except eplorer doesn't display you these very options, usually

You say MS can't speed windows up, but that's precisely what they've done with Windows 7.

No they have not -> They made explorer faster and that's it. You think it's faster untill you benchmark your applications...

In many cases it's faster even than XP on the same hardware,[...]

Whoa, which cases? You mean they have done a good job by making better use of hardware that previously manufacturers had to write functionality for? Yes that is certainly the case. Also; some games were optimised for Vista and are supposed to be faster on Windows 7 than on XP simply because of bad porting. In all of my cases with Windows 7 (yes I tried it and by trying I mean installing and not on a VM) everything was slower and I have serious hardware...

[...] and it scales much better to high end enterprise machines thanks to finer grained locking in the task scheduler and memory subsystems.

Here we go again; tuning, tuning, tuning... It's like wi

Re:pwned

[ThaReetLad]

Have actually created a limited user account (as opposed to an administrator one) on XP?

I'm sorry, I simply do not believe you can kill the graphics driver in XP as a limited user. Maybe kill the user mode control panel bit, but not the driver or you'd have a blank screen.

Windows 7 is now basically, in contrast to lies, lies and even more lies, except for the kernel; Windows 3.x+95+98+2000+XP+Vista = Windows 7. It's rediculous and unbelievable, yet still very true... Which is the reason why some very, very old Windows apps (like win98) can still run on Windows 7. They keep expanding and expanding on what they have and almost nothing gets rewritten, which is why each version of Windows is getting slower and slower.

The API is extended, and is constantly getting larger, and this is a good thing (although it does make for a complex and inconsistent API), because backwards compatibility is vital, and key to the reason why Windows will keep beating linux and Mac on the desktop. You should read Raymond Chen for some of the crazy stuff Microsoft have added over the years to maintain compatibility for apps which break the rules. Did you know there is a special memory allocation mode just for Sim City because it expects freed memory to still be accessible for some time, as it was in some early version of windows? Word 2.0 still runs, unmodified, on Vista! Businesses and users appreciate this. BUT this is not why it has got slower. Adding API's does not really slow anything down. Adding feature does. It has got slower because people expect an OS to do more, and to be more secure. The more that the OS does, the more it has to mode switch between kernel and user mode, which is very slow. These days the hard disk is a huge bottleneck because as the OS has tried to do more, the available data from the hard disk has not been able to keep up.

Of course they can't make raw CPU calculations faster! This is a OS, not a hardware upgrade!
The improved responsiveness of the OS is about the only performance measure that actually tests what the OS does. Third party applications simply don't make use of OS code enough to provide useful information about OS performance. The only useful measure involving third party applications and the OS is launch time.
Anecdotally, I am running XP pro on my work machine (quad core) and my windows 7 laptop is much more responsive machine, even with just 2, slower cores.
Word, excel, visual studio all start faster on the windows 7 laptop than on the win XP desktop

Re:pwned

[V!NCENT]

Have actually created a limited user account (as opposed to an administrator one) on XP?

I just created a user account. I don't know if it's limited or whatever. You can choose between admin, user and guest.

I'm sorry, I simply do not believe you can kill the graphics driver in XP as a limited user. Maybe kill the user mode control panel bit, but not the driver or you'd have a blank screen.

At first the screen freezes, shortly after that it goes blank (as in no framebuffer on the screen anymore) then the music still playes but after a few seconds it chockes (you know, that looping) like at 200bpm and then the sound stops and then... nothing... With the semi-realtime playback in XP I think that shows that the kernel crashes. Hitting the soft-shutdown button also doesn't shut the system down anymore so yeah...

The API is extended, and is constantly getting larger, and this is a good thing (although it does make for a complex and inconsistent API), because backwards compatibility is vital, and key to the reason why Windows will keep beating linux and Mac on the desktop.

Backwards compatibility is seriously declining. Starting with XP I already have a few games from the 'Pentium 3 era' that don't even run anymore. I need Wine for that. Ofcourse I do also need to mention that a lot more games still work good on Windows and absolutely crappy on Wine.

Adding API's does not really slow anything down. Adding feature does. It has got slower because people expect an OS to do more, and to be more secure.

Ehm, no offense, but KDE 4.3 has more features than Windows 7 and is much faster than explorer. Yet Microsoft has unlimited money and top-notch programmers on a payroll and Windows 7 is much slower. Expnding the API's is good, but expending upon a deep Win3.x subsystem at Win7's core is a completely different story. It's insane...

The more that the OS does, the more it has to mode switch between kernel and user mode, which is very slow. These days the hard disk is a huge bottleneck because as the OS has tried to do more, the available data from the hard disk has not been able to keep up.

While true about the slowness of the HDD; the OS is there to make your hardware run, not the other way around. Windows should adept to hardware and you can't blame HDD's for 'not keeping up with Windows'. That's just plain wrong...

Of course they can't make raw CPU calculations faster! This is a OS, not a hardware upgrade!

I think that we are talking about two different things. No the OS can't make single CPU calculations go faster! :) What an OS can do is demand a lot of raw CPU calculations and so less calculations are available for a given application in terms of time.

The improved responsiveness of the OS is about the only performance measure that actually tests what the OS does.

Also very true, but, a frontend of an app may run faster, however the speed of the backend sucks on Windows 7. You can't deny that. For example: encoding, decoding, compressing, reading, writing, rendering... all that stuff is slower, while the menu's for the graphical frontend might pop up faster. That's a huge difference. Not to mention games that do not rely on GDI at all. You see the biggest performance hits there. Even with Crysis for gods sake! :P xD

Third party applications simply don't make use of OS code enough to provide useful information about OS performance. The only useful measure involving third party applications and the OS is launch time. Anecdotally, I am running XP pro on my work machine (quad core) and my windows 7 laptop is much more responsive machine, even with just 2, slower cores. Word, excel, visual studio all start faster on the windows 7 laptop than on the win XP desktop

Enter uncom

Ahh...

[clone53421]

So that's what the NULL pointers were for.

Re:Ahh...

[Anonymous Coward]

Its from April of this year? Already a patch out old news

Re:Ahh...

[PhilPSU]

The biased /.er. It doesn't matter that it was a 8 year old really bad exploit. If it was MS this post would have been on the same day as it was found and everyone laughing at how lame Win is. Not for the /.ers. Nope focus on the fact the article didn't get posted here till today and that "hey, look its already been patched way back in april of this year no worries WE WIN!!

Re:Ahh...

[alexborges]

Not so. We just simply get this fixed within days of an exploit being discovered.

Windows, on the other hand, STILL, TODAY, HAS local root exploits that are plain UNPATCHED.

Microsoft just doesnt give a fuck about their customer's security. And thats that.

Re:Ahh...

[Anonymous Coward]

Before downmodding this to hell, note that if this were Java, AppleTalk implementers would have seen that sock_sendpage() is not implemented at compile time.

But wait... Wouldn't tools like Coverity and Fortify detect these kinds of vulnerabilites?

Re:Ahh...

[pugugly]

The problem is, if this were an eight year old really bad exploit in Windows, the article would be explaining how the authors pointed this out to Microsoft 7 years and six months ago, were threatened with legal hell if they said anything to anyone, the exploit has been in the wild though three versions of windows for six years, they finally managed to get a gag order revoked now, and we're just now finding out about it.

Instead we are finding out about an old, but only just uncovered (by white hat) exploit, and there is a reasonable chance my PC will be patched by the time I get home tonight.

A 'bias' or 'prejudice' is judging in advance of the facts. When a judgment is based on a long prior history, the term is 'Experience'.

Pug

Re:Ahh...

[xtracto]

Windows, on the other hand, STILL, TODAY, HAS local root exploits that are plain UNPATCHED.

[citation needed]
Preferably for:
Microsoft Windows XP [Version 5.1.2600]

Re:Ahh...

[duguk]

There's a metric fuck-ton on Secunia.com, not least of all the emf file handling.

I'm safe!

[Anonymous Coward]

I use Windows!

Re:I'm safe!

[nschubach]

I'm sorry. ;)

Re:I'm safe!

[dgatwood]

Once again, my 2.0 Linux kernel is safe!

Re:I'm safe!

[Bandman]

Excellent. My old 2.2-based Slack 8 boxes should be fine, too.

Can't trust that new-fangled 2.4 stuff. USB support? Who needs it!

Re:I'm safe!

[tenco]

(...) Ubuntu (...) more stable (...) more stable (...)

FAIL.

Re:I'm safe!

[Anonymous Coward]

I use Windows!

Notably, the privilege escalation issue that faces Linux Kernels now is actually the *default* situation in XP. Most users on XP are administrators. So, no, Linux users are now about as safe as you are.

Re:I'm safe!

[Anonymous Coward]

yes you are!

Re:I'm safe!

[cenc]

If you pick a bleeding edge distro like Ubuntu, that is what you get.

There is a reason server distros red hat and the like, are super "outdated" by Ubuntu user standards. They are patched regularly, security fixes are added, perhaps some hardware support, but it is patching a static target rather than the flavor of the month kernel, drivers, and every other thing including patching the kitchen sink. Pick a conservative distro if you want stability.

Everyone has to learn in the hard way sooner or later, myself included. Thus, why I don't use windows anymore.

Re:I'm safe!

[arndawg]

2009 called. Windows Vista and Windows 7 is out!

Re:I'm safe!

[Dragonslicer]

Today, I updated my Ubuntu for sixth time this year . This will be seventh.

You've only run apt update/upgrade once per month? Are you complaining that that's too frequent? I get updated packages every few days or so on average, so I'm not sure what your point is.

Re:I'm safe!

[Anonymous Coward]

Reality called. Windows XP has 10x the installed base of Vista and Windows 7 combined.

Re:I'm safe!

[jhol13]

#1 complaint of linux fanboys: "you use wrong distro".

Unfortunately there is no distro which does not pose the same problem: I still have to recompile every non-kernel device driver in every kernel patch.
BTW, I use LTS (i.e. 8.04), not Windows.

Re:I'm safe!

[jhol13]

I was talking about the kernel. With the kernel there is a problem which other updates do not pose: it breaks other SW.

Re:I'm safe!

[Anonymous Coward]

I don't trust that 2.0 kernel yet. I'll stick with 1.2.13 for the time being.

Re:I'm safe!

[hawk]

These things happen when you use versions labeled 1.0 and higher . . .

hawk

Security through Obscurity?

[MarkvW]

Does this mean that Linux was never more secure than Windows--only more obscure?

Re:Security through Obscurity?

[ammorais]

Does this mean that Linux was never more secure than Windows--only more obscure?

No.
You could have a point if this was resolved only 6-12 months after it's discovery.

Re:Security through Obscurity?

[TheRealMindChild]

Well, all Microsoft OS's would fault when trying to execute code at a NULL address, merely because people needed to use something to signify an uninitialized pointer. Most operating systems do this. Apparently (I could be wrong, the article is short on details and I don't play in that part of the kernel), this is due to an optimization and not necessarily the original intention.

Re:Security through Obscurity?

[Anonymous Coward]

uh huh..and the 8 years it took to discover don't matter, eh?

Re:Security through Obscurity?

[Galestar]

Yes. Exactly.

Re:Security through Obscurity?

[dissy]

Does this mean that Linux was never more secure than Windows--only more obscure?

It's hardly obscure since they could look and find it, evidenced by the fact they found it.

Go try that with the Windows kernels!

In addition, there is already a patch out for this, which by end of the week will be pushed down from the distro managers. We don't have to wait years after finding it for the fix to be released, as Microsoft historically does.

In fact, why just assume this similar bug is NOT in the windows kernel? Did you check? Did any reputable security company check?
I'm not saying it is there, only that you can't easily prove otherwise.

*that* is the security being spoken of.

As far as I know, only one OS claims no exploits, and that is OpenBSD.

Re:Security through Obscurity?

[Romancer]

Little faster than that:

-
Solution
-

Linus committed a patch correcting this issue on 13th August 2009.

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98

-
Credit
-

This bug was discovered by Tavis Ormandy and Julien Tinnes of the Google
Security Team.

Re:Security through Obscurity?

[gbarules2999]

No. It means nobody noticed this flaw yet. If someone had, then it would have been used against all the servers that support the world's webpages. Wikipedia's Ubuntu servers, for example, or getting deeper, something like Amazon.

Re:Security through Obscurity?

[amorsen]

Generally people don't care about local privilege escalation on Windows. Like this vulnerability.

Re:Security through Obscurity?

[ammorais]

No. If nobody knew it wasn't a security issue. I'm sure there are bugs on every OS with more than 8 years old yet to discover.

Re:Security through Obscurity?

[Henry V .009]

From your link, it looks like it was patched as an "Important" security vulnerability.

Re:Security through Obscurity?

[Anonymous Coward]

You're wrong BTW, they claim 2 exploits at this point, once dating from '05 was it? And the other from either this year or last year :)

Re:Security through Obscurity?

[Anonymous Coward]

How do you know that nobody knew about it. It could have been a nice little tool for somebody for years.

Re:Security through Obscurity?

[Anonymous Coward]

Does this mean that Linux was never more secure than Windows--only more obscure?

No. If nobody knew it wasn't a security issue.

Isn't that exactly what security through obscurity means?!

Re:Security through Obscurity?

[Bandman]

Yeah, I can't buy this, and neither should you.

Really, just because they're not common knowledge doesn't mean that no one has found them.

Re:Security through Obscurity?

[Bandman]

From reading the docs, it sounds like it would be difficult to exploit via web browser, since it requires a local account.

Now, if you compromised the web server using a vulnerability, and used the web server's account, you could have escalated yourself to root and done what you wanted then.

Re:Security through Obscurity?

[molo]

Important, not "Critical". And there are a bunch like that on every Patch Tuesday,

-molo

Re:Security through Obscurity?

[recoiledsnake]

Does this mean that Linux was never more secure than Windows--only more obscure?

It's hardly obscure since they could look and find it, evidenced by the fact they found it.

Go try that with the Windows kernels!

In addition, there is already a patch out for this, which by end of the week will be pushed down from the distro managers. We don't have to wait years after finding it for the fix to be released, as Microsoft historically does.

In fact, why just assume this similar bug is NOT in the windows kernel? Did you check? Did any reputable security company check?
I'm not saying it is there, only that you can't easily prove otherwise.

*that* is the security being spoken of.

As far as I know, only one OS claims no exploits, and that is OpenBSD.

The transparent thing works both ways... it's easier for black hats to find holes too, by your own logic. And they can keep it secret and exploit it as long as they can. A similar bug existing in Windows doesn't prove anything and is irrelevant here. After all 'M$ can't code shit'. Linux and FOSS is commonly claimed to be more secure because of it's development model and bug free here in these parts. Any data that runs counter to this is routinely downplayed by commenters and moderators... just like your post got modded up.

Re:Security through Obscurity?

[Sinbios]

It's hardly obscure since they could look and find it, evidenced by the fact they found it.

Yeah, it only took eight years.

Go try that with the Windows kernels!

So if Windows kernels are more obscure, does that make them more secure?

In addition, there is already a patch out for this, which by end of the week will be pushed down from the distro managers. We don't have to wait years after finding it for the fix to be released, as Microsoft historically does.

The blog post never mentioned when it was discovered, just "recently". For all anyone knows they could have been doing Linus a favour and kept their mouths shut until Linus came out with a patch, seeing as the very post that announced the exploit already linked to the patch. In a situation like this with Microsoft, do you think they'd exercise the same grace?

Re:Security through Obscurity?

[ammorais]

I don't know what do you mean with Obscurity.
For me obscurity is closed source code. It's to try to hide vulnerabilities from the public to argue that it's more safe.
Obscurity for me definitely isn't posting a patch in the same day that the vulnerability is discovered.

Re:Security through Obscurity?

[recoiledsnake]

Linux runs on a lot of shell servers, gameservers, webhosts etc. where normal user accounts are sold to customers. This happens much less with Windows servers which tend to be more owned and used by a single entity with full admin rights.

Re:Security through Obscurity?

[DavidTC]

Yes, but generally exploits get discovered by others if they are used.

At some point, someone curious will get hacked, and wonder how the hell that happened, and track down the exploit.

And that's not even including discovery on the cracker's side. (People he works with, etc.)

The only way to keep an exploit a secret is to (almost) never use it. It's going to be made public within a few months of even low usage.

Re:Security through Obscurity?

[DavidTC]

Didn't we just have some sort of security issue with pulseadio and a NULL pointer?

Seriously, how hard is it for the OS to just blow up whatever program is running if it tries to access the memory location NULL, period? That is not a valid memory location, you cannot put things there, if you access it in any way, you die, no exceptions.

Re:Security through Obscurity?

[spun]

No. If nobody knew it wasn't a security issue. I'm sure there are bugs on every OS with more than 8 years old yet to discover.

You veered completely off track right about here: "If nobody knew"

Seriously? Really, that's the best you could come up with? That's your apologia? How do you know nobody knew? You think the real blackhats are going publicizing their 'sploits? Blackhats these days aren't script kiddies and honest hackers, they are hard core Russian mafia doing it for cash. Your Linux systems could have been owned twelve ways from Sunday for EIGHT YEARS without you ever knowing it, and you are claiming 'it wasn't a security issue?' WTF? When did Linux get infested with idiot fanboys? Shouldn't you be slobbing all over an Apple or something? I was using Linux before you even knew what Unix was, I despise Microsoft and love open source, but a bug is a bug.

Try this one: 'No. Because it's a freaking LOCAL EXPLOIT and nearly no-one uses Linux for multi-user systems now that everyone can afford their OWN FREAKING COMPUTER.' Good lord, kids these days, gotta teach them everything.

Re:Security through Obscurity?

[oxfletch]

Which part of "local" are you not understanding?

Re:Security through Obscurity?

[freeweed]

Your post got modded up, too.

Re:Security through Obscurity?

[ammorais]

It's impossible to have a complex system without bugs. The speed that they are addressed once they are discovered tells much about the system. Also it's very unlikely that a severe exploit stays secret once it's discovered unless it's not used.

Re:Security through Obscurity?

[amorsen]

Sure, it was patched, but it wasn't exactly all over the news. Neither is this one for Linux, but it managed to get mentioned on Slashdot.

Local privilege escalation is hard to guard against with current mainstream operating systems. The attack surface is very large and it is hard to completely verify interfaces. That said, Linux team seems to be doing fairly well overall. We're certainly a long way from the "good" old days when crashme would crash pretty much any Unix system. OpenBSD is doing even better, masturbating monkeys or not.

Re:Security through Obscurity?

[AuMatar]

The OS doesn't know every memory address an application tries to access. This type of behavior would need to be built into the CPU (call an interrupt if that occurs), not the OS level.

Re:Security through Obscurity?

[PopeRatzo]

I'm sure there are bugs on every OS with more than 8 years old yet to discover.

Oh, then it's OK.

Re:Security through Obscurity?

[PopeRatzo]

I don't know what do you mean with Obscurity.

Since there seems to be some confusion, let me help:

From Webster:"shrouded in or hidden by darkness c : not clearly seen or easily distinguished : faint 2 : not readily understood or clearly expressed"

Obscurity for me definitely isn't posting a patch in the same day that the vulnerability is discovered.

We only know that Tavis Ormandy and Julien Tinnes discovered it the day before the patch came out. Hackers, who by definition operate in obscurity, may have known about it earlier. The fact that Travis and Julien found it after eight years pretty much means that the flaw existed in obscurity.

We hope.

Re:Security through Obscurity?

[taviso]

Actually, it is possible to map at NULL in Windows, which is just as plagued by NULL pointer dereferences as Linux is.

Try this:

BaseAddress = (PVOID) 0x00000001; // (1 & ~PAGE_SIZE) == NULL
RegionSize = 0x1000;
NtAllocateVirtualMemory(GetCurrentProcess(), &BaseAddress, 0, &RegionSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

Re:Security through Obscurity?

[ckaminski]

Yes, it's called hardware level paging, and it's been around for 20+ years. This is a known problem. The problem is from how the exceptional condition (null pointer access) is handled by the kernel, and not the fact that NULL was called. The OS knows EVERY memory access that requires a page to be fetched from disk, that's a function of the memory management unit, and can be told of every access that tries to access an unmapped memory location. This isn't state of the art, this stuff is old hat (Linux and Windows).

So it's an OS bug, through and through, and yes, it's been fixed. Joy.

Re:Security through Obscurity?

[ammorais]

Since you are argue here that your dick is bigger than mine, because you use you use UNIX longer than me I suspect I can't really have a civilized conversation with you.
Also I'm programmer with several works published in open-source from encryption to network programming, so I can hardly be considered a fan-boy.

And yes. If nobody knew it wasn't a security issue.
What is it in If nobody knew that you don't understand?
If some hacker knew != "If nobody knew".You could have what we Linux "fun-boys" called an algorithmic thinking to figure this out.

By the way.

No. Because it's a freaking LOCAL EXPLOIT and nearly no-one uses Linux for multi-user systems now that everyone can afford their OWN FREAKING COMPUTER.

You don't need to have physical access to use this exploit. It can bed done with SSH or any kind of remote user login with limited privileges. Who's the fan-boy now.

Re:Security through Obscurity?

[rjstanford]

Not really. The OS provides virtual memory space to each program running underneath it - this helps prevent the happy fun times you may have had as a child (or younger adult) using PEEK and POKE on early micros. Any reference to memory ultimately has to be run through the OS tables to figure out what the correct memory location is, so that the contents can be served to the application. I (having in glorious /. fashion not bothered to read the article) am not sure why memory reference zero would be shared at all.

NOTE: All applications may request shared memory space through which to talk to each other. It would be highly reasonable to deny any request for shared memory with an address of 0... And in any case, this shouldn't affect anyone else either with a reasonable memory subsystem. Otherwise, if your userland program knew my userland program's address space you could read my state, which is obviously not possible.

Then again, maybe due to the fact that this has the kernel executing said code, its not a userland issue after all. The real problem (apart from the NULL==0 thing) is that a userland app managed to put code at position 0 of the kernel space in the first place. Anything running with kernel privs can do whatever it wishes already, of course.

Re:Security through Obscurity?

[Vexorian]

It was fixed much faster than MS after it was announced. I guess it is 100000 times faster than your usual MS flaw. So, yeah Linux is more secure.

Also, did you bother reading what this exploit does? It is very bad because it allows user programs to gain administrator privileges. This is insecure because it puts Linux in a category that's as insecure as all pre-vista windows computers and also the UAC-enabled-because-else-it-is-useless vista and 7 computers. That's the problem here, it moves Linux to a windows state...

Finally, it is easier to find flaws in Linux, this increases the chances blackhats found bugs, but it also increases the chances someone else will find it in paralel, preventing your hypothetical situation...

Ironically, it is because of some artificial obscurity that this bug was present and took so long to find. Most vulnerabilities aren't caused by obscure optimization issues, and are findable in source code, those were a non-issue thanks to the lack of obscurity. So this actually proves obscurity != security.

Re:Security through Obscurity?

[Verdatum]

nearly no-one uses Linux for multi-user systems

Except for all the universities. Otherwise, your comment is dead-on; fanboys of any flavor should get off my lawn.

Re:Security through Obscurity?

[Anonymous Coward]

uh huh..and the 8 years it took to discover don't matter, eh?

You mean the 8 years it went unnoticed by mainstream zealots?

Re:Security through Obscurity?

[_Sprocket_]

The blog post never mentioned when it was discovered, just "recently". For all anyone knows they could have been doing Linus a favour and kept their mouths shut until Linus came out with a patch, seeing as the very post that announced the exploit already linked to the patch. In a situation like this with Microsoft, do you think they'd exercise the same grace?

Certainly. It's billed as "responsible disclosure" and Microsoft strongly supports it. Many Microsoft vulnerabilities aren't reported until after patches are released. Some vulnerabilities remain in limbo for an extended period of time.

Re:Security through Obscurity?

[ammorais]

What are you asking me? If it's OK OS's to have bugs.
No. It's not ok. But it's inevitable.

Re:Security through Obscurity?

[schon]

The fact that Travis and Julien found it after eight years pretty much means that the flaw existed in obscurity.

Except for the fact that it was out in the open (being open source and all), which pretty much means it was not in "obscurity".

Just because something isn't known doesn't mean someone is trying to hide it.

Re:Security through Obscurity?

[Henry V .009]

I believe that "Critical" updates usually need to be remote.

Re:Security through Obscurity?

[Stupendoussteve]

This is very true, such as The 25 Year-Old BSD Bug

Re:Security through Obscurity?

[betterunixthanunix]

Keep in mind that this vulnerability can only be exploited by someone who already has access to the system, and is allowed to execute arbitrary binary code on the system, two hurdles that are fairly easy to correct. Linux is also constantly pounded away at by security researchers, and it is not at all obscure among the security community.

Re:Security through Obscurity?

[amicusNYCL]

No man, the OS is responsible for memory management. That's a major part of any OS, right up there with the scheduler. The memory management portion is responsible for allocating memory to an application and also for making sure that an application only accesses its own memory, or shared memory. So when an application tries to access a memory address you better believe that the OS is verifying that the application is allowed to do that. When an application tries to access memory that it doesn't own, that's one kind of general protection fault or page fault on Windows. The memory garbage collection routines definitely need to know which portions of memory are allocated to a certain process. Memory management is a major part of the Linux kernel. Here you go:

http://linux-mm.org/

Re:Security through Obscurity?

[losinggeneration]

Sure it did, but there wasn't a (public?) exploit for all 8 years either was there? Not to mention if they weren't crawling the code looking for it they may not have ever just stubled upon it (or maybe they would have.) Either way, having the source code available at least allows for this kind of scrutiny.

Re:Security through Obscurity?

[AmberBlackCat]

What would be really wild is if it only took the "good guys" 8 years to discover it. And all the people on Slashdot who are still bashing Windows even in the midst of this are giving themselves a big pat on the back while posting on their rootkitted Linux machines.

Re:Security through Obscurity?

[alexborges]

Can you really think clearly for a second and understand that ALL SOFTWARE HAS BUGS?

And that, if we talk about security, there is a difference between a disclosed exploit, a zero day exploit, a bug that COULD be exploited (which is this case in particular) and that the argument you pretend to make applies to ALL FUCKING OSES?

Re:Security through Obscurity?

[alexborges]

They claim no REMOTE ROOT exploits in a vanilla installation of their OS...

Which, by the way, I can easily produce with a single IP tables rule and also applies to redhat or any distro if you turn on the firewall from the start.

Re:Security through Obscurity?

[amicusNYCL]

sigh..

http://www.google.com/search?q=windows+hosting (36.4 million results)

http://www.google.com/search?q=linux+hosting (19.3 million results)

Re:Security through Obscurity?

[medv4380]

I don't think anyone who runs and uses Linux on a serious level believes any software (even Linux) is bug free. The development model in Linux is better mostly due to the level of documentation that goes into public code. What is being illustrated is how bugs are found and resolved in a timely manner in Linux. MS has their own way of doing things, and in some ways it causes many of their problems. If MS had as much respect for documenting their own code as the Linux developers do then the MSDN library wouldn't be as worthless as it is since they have undocumented features all over the place or are those bugs. MS does respond to security issues but it gives the appearance of responding to them way too late. For example simple things like adding a firewall didn't occur to them until years after Linux distributors had made it apart of most if not all installs.

Re:Security through Obscurity?

[amicusNYCL]

And yes. If nobody knew it wasn't a security issue.

No, moron. If nobody knew then it's a security issue that nobody knew about. It's still a security issue. Unless your name happens to be Schrodinger, a thing is still a thing even if no one is looking at it.

If a tree falls in the forest, and no one's around...

Re:Security through Obscurity?

[__aagmrb7289]

Which works are those? I'm guessing, pending on the direction this conversation goes, people are going to want to know. Money is scarce these days, you know - wouldn't want to waste it.

Re:Security through Obscurity?

[jmac_the_man]

Theoretical nefarious hackers who discovered the flaw before Travis and Julien would have been trying to hide it. Just because something isn't known doesn't mean it doesn't exist.

Security through obscurity does mean the thought that that as long as no one knows about it, it's not an issue. Being open source doesn't make you immune to this. What would make you immune to this would be formal testing and security audits of every component, like is done on things like the space shuttle. This is generally prohibitively expensive for situations where actual life and limb danger isn't a factor, which is why no commonly used operating system implements this strict security level. Sure, having a lot of eyes looking at the Linux kernel helps (and it eventually worked in this case) but just being open source doesn't mean it's secure.

Re:Security through Obscurity?

[egcagrac0]

"More secure" is an inaccurate conclusion in this instance. It would imply that there are more instances of problems of comparable severity in the other OS kernel.

"Shorter time to resolution" is more accurate.

Re:Security through Obscurity?

[jmac_the_man]

Yeah, but it will take Slashdot less than eight years to fix that problem.

Re:Security through Obscurity?

[ClosedSource]

Apparently F/OSS's "many eyes" were too busy looking at porn for the last 8 years.

Re:Security through Obscurity?

[ammorais]

You keep calling me kid even tough you don't know my age. Stop being condescending. I am not a kid, and you are being rude. It doesn't make your point or make you look smarter or wiser.

This is a privilege escalation, not a remote exploit. Learn the difference.

If I didn't knew the difference I wouldn't post the SSH example. Also SSH is used in many servers trough non-VM based servers(at least in my country).

I probably didn't understand the total meaning of "Obscurity" word well since English is not my first language, with I already pointed out in another response, but this doesn't give you the right or to call me fan-boy or kid or whatever. If you are frustrated with someone go point your rage at someone else. Don't pick up guys that you don't know on the net with personal attacks, and try to be intellectually honest.

Re:Security through Obscurity?

[DMUTPeregrine]

Exactly. And it's not a claim that they have none, it's a claim that none have been found. From their own security faq:

We do not find as many problems anymore, it is simply a case of diminishing returns. Recently the security problems we find and fix tend to be significantly more obscure or complicated. Still we will persist for a number of reasons:

* Occasionally we find a simple problem we missed earlier. Doh!
* Security is like an arms race; the best attackers will continue to search for more complicated exploits, so we will too.
* Finding and fixing subtle flaws in complicated software is a lot of fun.

The auditing process is not over yet, and as you can see we continue to find and fix new security flaws.

That page has a list of security advisories in their releases. They're fixed in the current branch, but it proves that they acknowledge when they have holes & then fix them.

Re:Security through Obscurity?

[0xABADC0DA]

Yes, it's called hardware level paging ... The problem is from how the exceptional condition (null pointer access) is handled by the kernel, and not the fact that NULL was called.

No, it's not. The problem is that the kernel also has access to the process's memory, so if the process mapped page 0 as r-x then the kernel also has that page. So when the kernel jumps to NULL through a function pointer, it runs whatever code the process put there.

This mapping is done for efficiency because otherwise any system call would flush TLB at least *twice* and it would be slow as hell.

Hardware memory protection is as old as dirt, but it's also a brutish fossil, symbolic of a decayed era, gratefully forgotten.

Re:Security through Obscurity?

[quercus.aeternam]

Yes, it's a definite problem.

However, it seems likely that it had not previously been discovered by black hats, due to the apparent lack of exploits.

Of course, that begs the question - would a black hat exploit the vulnerability for all it's worth until the flaw was determined, or use it on a select few systems?
The more widely-used the vulnerability, the sooner it would be found - but the greater the immediate reward...

Re:Security through Obscurity?

[ammorais]

If a tree falls in the forest, and no one's around...

http://en.wikipedia.org/wiki/Schr%C3%B6dinger's_cat

No, moron. If nobody knew then it's a security issue that nobody knew about. It's still a security issue.

"every problem is a people problem".

Re:Security through Obscurity?

[onkelonkel]

"ALL SOFTWARE HAS BUGS"

Not mine. Speak for yourself.

Re:Security through Obscurity?

[alexborges]

Sorry, God, I forgot you.

Re:Security through Obscurity?

[Anonymous Coward]

"Because Windows isn't a REAL server or multi-user operating system, its many and frequent local escalation flaws are not a problem"

Thanks for clearing that up.

Re:Security through Obscurity?

[alexborges]

Ah... you want the linux community to fix bugs it doesnt know about?

Well... thats like asking the genie in the bottle for "World Peace": "I do wishes, not miracles".

Re:Security through Obscurity?

[alexborges]

And unless programmers are magically endowed with omniscience, you need to KNOW ABOUT A BUG before fixing it.

Re:Security through Obscurity?

[Grishnakh]

Is this like some kind of (biological) virus that might just be out there, wreaking havoc and killing people, even though there's absolutely no evidence of such a virus? That makes no sense at all.

If this exploit were already known by people with malintent, they would have used it already, and it would be known more widely. Note that this works for both open-source and closed-source code. The main advantage with open-source code is that anyone can look through the code for problems; this doesn't mean that they do. But it looks like this exploit was found by some researchers, not the kernel developers. This is something that can't be done in the closed-source world, so theoretically there should be fewer exploits in OSS code overall.

In reality, however, I think the issue of closed-source vs. open-source really doesn't make that much difference when it comes to security. What does make a huge difference is Microsoft's crappy code and architecture, with idiotic things like ActiveX. OSS code would have the same problems if their developers made such poor choices; it's just that OSS coders aren't driven by marketing the way MS (and other proprietary companies) is, forcing them to make poor architectural choices because marketing thinks customers will like it better.

Re:Security through Obscurity?

[brunoacf]

Does this mean that Linux was never more secure than Windows--only more obscure?

No. Linux is open source and everybody can read its source. So, its security is not based on obscurity. In fact, Windows (source) is much more obscure.

Re:Security through Obscurity?

[alexborges]

Yes...

Do YOU know how many undiscovered bugs are in windows?

NO!

Because hell, YOU CANT KNOW what you dont have access to. Linux, at least, can be checked and rechecked and sooner or later someone will find the bug.

In the case of windows, perhaps even now there are tremendous remote root exploits that are being actively used that you dont know about. And if those follow the trends of virii or other exploit info that is available, its probably a number of undisclosed exploits like 100000 larger than all you could find in Linux.

Re:Security through Obscurity?

[amicusNYCL]

Yes, I agree with that statement. I do not believe that it's possible to fix a bug without knowing about it. However, even if you don't know about the bug, it's still a bug.

Re:Security through Obscurity?

[alexborges]

How can they all be rootkitted if its a local root exploit, not a remote one.

Re:Security through Obscurity?

[amicusNYCL]

Did you just link me to a reference that I gave you?

Re:Security through Obscurity?

[alexborges]

Yeah. And we still make a better OS than the people that actually get paid to fix them in other oses....

So pr0n==good programming and bugfixing.

Re:Security through Obscurity?

[cenc]

What the hell. The earth is full of bugs. He is can't produce bug free hardware or software either.

Re:Security through Obscurity?

[cenc]

It is only really a bug or security concern if it interrupts FOSS guys watching porn.

Re:Security through Obscurity?

[martyros]

It turns out that it's not simple to map NULL, but unfortunately (from a security standpoint) not impossible. It's normally disallowed, but since there are programs that sometimes need it (namely domemu-style programs). See this LWN article describing the previous NULL-dereference exploit. Presumably the seriousness of this NULL pointer exploit inspired others to look for exploitable NULL pointer bugs as well.

Re:Security through Obscurity?

[ammorais]

I've gave you the Schrödinger's cat and the "every problem is a people's problem" examples to make a point that if a problem exists and no one know about it, and in any way it interferes with nothing in the present or in the future, for practical means, it isn't a problem.
Of course the issue exists in reality. I'm not a moron that don't understand that things have to be acknowledged to exist, but you are the one who failed to understand the true meaning of what I've wrote, instead of using literal interpretation to call me a moron and to be offensive.

Re:Security through Obscurity?

[malevolentjelly]

It was fixed much faster than MS after it was announced. I guess it is 100000 times faster than your usual MS flaw. So, yeah Linux is more secure.

So Linus commits a patch to the bleeding edge repository and it's "Fixed"? Do you really think that fixes to Windows only appear when the patch comes about? No, after the patch has been implemented internally and verified by the security teams and run through QA it is rolled into a safe patch and spread out to ALL windows machines. I'd say that's much faster and less complex than the rounds this patch needs to make as it slips out to the distros and is backported into the various kernels-- and with far less testing and QA. You ride by the seat of your pants with Linux.

Also, did you bother reading what this exploit does? It is very bad because it allows user programs to gain administrator privileges. This is insecure because it puts Linux in a category that's as insecure as all pre-vista windows computers and also the UAC-enabled-because-else-it-is-useless vista and 7 computers. That's the problem here, it moves Linux to a windows state...

Limited accounts are a Windows NT feature. Are you talking about DOS-based Windows? And Linux doesn't offer the sort of security UAC does. You can't casually SUID 0 past UAC with limited access.

Finally, it is easier to find flaws in Linux, this increases the chances blackhats found bugs, but it also increases the chances someone else will find it in paralel, preventing your hypothetical situation...

Haha... you really think white hats without a profit motive are going to get to the good stuff first? Exploits are expensive, man. You simply assume that the white hats are as skilled as the black hats, which is economically improbable. Well, obviously after 8 years of wide open system, they're just not that impressive. The most prevailing force in any software project is laziness, so if security and quality are not checked and double checked in an enforced manner by those with incentive to do so, it likely won't happen. Serious security professionals are high paid fellows who can't be babysitting every code commit in the tangled mess that is the linux kernel. There's just way too much ground to cover. The NT kernel is tiny in comparison.

Ironically, it is because of some artificial obscurity that this bug was present and took so long to find. Most vulnerabilities aren't caused by obscure optimization issues, and are findable in source code, those were a non-issue thanks to the lack of obscurity. So this actually proves obscurity != security.

No, it doesn't. It proves that security is a careful process and that writing and maintaining advanced systems code should be left in the hands of professionals. Security v. obscurity is not the issue here. This was an amateur oversight.

Sorry bitches, today is Windows Day and I am wearing my NT kernel proud. I'm going to go boot up my Windows 7 box and just cackle madly for a while.

Re:Security through Obscurity?

[Anonymous Coward]

I can hardly wait for the Ubuntu Masturbating Monkey release.

Re:Security through Obscurity?

[TCM]

And yes. If nobody knew it wasn't a security issue.
What is it in If nobody knew that you don't understand?
If some hacker knew != "If nobody knew".You could have what we Linux "fun-boys" called an algorithmic thinking to figure this out.

Yeah, well. You won the logic game. Congratulations.

Your statement just doesn't have any relevance to reality anymore.

Re:Security through Obscurity?

[Anonymous Coward]

This doesn't. Coincidence is a bitch.

Re:Security through Obscurity?

[amicusNYCL]

But that's what I do here.. I'm a lot like WNight, except I don't run Unix.

Re:Security through Obscurity?

[Rockoon]

It was fixed much faster than MS after it was announced.

The latest stable linux kernel release is 2.6.30.4 dated 7-30-2009.

Now, you were saying that "it was fixed" in the past-tense, which is clearly a lie. It hasn't been fixed by any reasonable measure, because almost every linux systems in the world right now is vulnerable to this (now) well known exploit, and even if you download the most recent kernel you are stick fucked.

Your first step, should you man up and drop the religion, is to be honest with yourself. Then you wouldn't so easily run the risk of being dishonest with others.

Re:Security through Obscurity?

[jcr]

I'm programmer with several works published in open-source from encryption to network programming, so I can hardly be considered a fan-boy.

Sure you can. Plenty of Real Programmers are fan-boys, too. You say that like being a fan is a bad thing.

-jcr

Re:Security through Obscurity?

[malevolentjelly]

The development model in Linux is better mostly due to the level of documentation that goes into public code.

Are you saying the Linux platform is more well documented than Windows? Are you high? When I think about the disparity between platforms, documentation is a serious high point for Windows. In Linux, your documentation is the source code. You read the source code if you want to understand the functionality of a certain driver or API.

What is being illustrated is how bugs are found and resolved in a timely manner in Linux.

An 8 year old bug is located and then Linus patches the mainline kernel in the repository. How is this faster? Is this patch in Ubuntu yet? How about Red Hat? Is it in the Linux servers on Wall Street yet? When Microsoft finds an exploit, this happens fairly quickly, but then the code goes through a serious review and QA process before being pushed to the entire platform worldwide. Does it really get to the customer quicker this way? Is it really safer? The difference here is that we know when the kernel architect has finished his patch... but seeing what happened here, I won't be shocked if another one of these appears in another few months. This was a pretty amateur hole.

For example simple things like adding a firewall didn't occur to them until years after Linux distributors had made it apart of most if not all installs.

Firewalls were third party turf. I think the idea was that firewalls are a network infrastructure issue, not an OS thing. They added a firewall, though. It's a bit easier to deal with than Linux's, also.

Re:Security through Obscurity?

[Rockoon]

For example simple things like adding a firewall didn't occur to them until years after Linux distributors had made it apart of most if not all installs.

I'm waiting for Comodo, ZoneAlarm, etc, to file complaints against Microsoft in the E.U. They shouldnt be allowed to leverage their monopoly position in the firewall market. We need a firewall ballot.

Re:Security through Obscurity?

[RichardJenkins]

No, security by obscurity is when you try to make something secure by purposefully obscuring it, (say you have an admin page on your site at http://mysite/mysecretadminpagethathasnopassword, or you have a known exploitable security issue and you keep it quiet instead of fixing it). Note that the 'obscurity' is something you introduce purposefully in a misguided attempt to secure a system. Having a privilege escalation bug which through bad luck/poor testing nobody goes unnoticed or unreported to the dev team for this long is either bad luck or evidence of sloppy work/poor testing/bad dev practices etc.

As for saying that a vulnerability is not a security issue if it hasn't been discovered: I guess that's technically true, but you have to be mindful of the fact that you have no way of knowing if or when it was discovered - particularly for one this old. Certainly when comparing different OS projects you could analyse the number, severity, time from public disclosure to patch and total time in the wild of security bugs to estimate how secure they are compared to each other.

My personal take on this specific issue is that if Linux were prominent on desktops this would be a moderate headache, but as things stand it's mostly just compounds vulnerabilities in userland apps on servers, and further exposes poorly administered servers.

Re:Security through Obscurity?

[TCM]

Yeah, because there never was a remote exploit in a non-root application. *rolls eyes*

Re:Security through Obscurity?

[apoc.famine]

The transparent thing works both ways... it's easier for white hats to find holes too, by your own logic. And they can publish them, and any system admin can then fix them immediately. A similar bug existing in Windows couldn't be found easily by white hats, nor patched quickly. After all 'M$ can't code shit'. Linux and FOSS are more secure because of their development model. Trolls like the poster above make up stupid shit that runs counter to this and idiots mod them up.
 
I can only hope that people with mod-points mod your asinine comments into trollish oblivion.

Re:Security through Obscurity?

[PopeRatzo]

Except for the fact that it was out in the open (being open source and all)

Then why did it take eight years to find?

See, there's obscurity because something is intentionally hidden, and then there's obscurity because something is a needle in a haystack.

Re:Security through Obscurity?

[ammorais]

I'm sorry. You are totally right.
I should have said: "so I can hardly be just considered a fan-boy."

Re:Security through Obscurity?

[RichardJenkins]

Try this one: 'No. Because it's a freaking LOCAL EXPLOIT and nearly no-one uses Linux for multi-user systems now that everyone can afford their OWN FREAKING COMPUTER.' Good lord, kids these days, gotta teach them everything.

Well we have a handful of people who use ssh to tunnel into some internal services - it's more convenient than a VPN and I don't think it's too uncommon.

With a well administered server, and a small trusted set of users I still don't think it presents much threat. I don't think it will take too many more of these to undermine peoples confidence in Linux security.

Re:Security through Obscurity?

[recoiledsnake]

So white hats can't easily find bugs in Windows but black hats can? I don't follow your logic.

Re:Security through Obscurity?

[Dragonslicer]

print "Hello, world"; doesn't count.

Re:Security through Obscurity?

[Anonymous Coward]

At some point, someone curious will get hacked, and wonder how the hell that happened, and track down the exploit.

And how?

Re:Security through Obscurity?

[gringer]

You keep calling me kid even tough you don't know my age. Stop being condescending. I am not a kid, and you are being rude.

Well, since you asked so kindly, the Google suggests that you'll turn 32 near the end of November this year. I'm assuming that's you, because that user (same ID) mentioned a home location in Portugal, and you have mentioned in previous /. posts that you live in Portugal.

Your confrontational behaviour is child-like, even if your age suggests otherwise. Oh, and mind the trolls on slashdot. They're all over the place....

Re:Security through Obscurity?

[noidentity]

Security through obscurity means intentionally keeping vulnerabilities/untested things from being known, not having bugs. Virtually everything has bugs. This is just a case of insecurity due to a bug. Don't water down the meaning of "security through obscurity".

Re:Security through Obscurity?

[Anonymous Coward]

The thing you're missing is that the kernel normally runs with a super-set of its own memory mappings and the user's memory mappings (so for instance if you call write(fd, buf, 100) it can read the data "buf" points to)

Typically NULL will always be an unmapped page but the user can manually map something there if they want... this is true on UNIX or windows (see taviso's comment above for the details) Newer linux kernels actually have a setting to prevent this (refusing to allow the user to map addresses 64K) but it breaks some programs.

So the exploiting program maps code at page zero, then causes the NULL dereference. Instead of kernel fault you'd expect, you get an exploit.

Re:Security through Obscurity?

[medv4380]

An 8 year old bug is located and then Linus patches the mainline kernel in the repository. How is this faster? Is this patch in Ubuntu yet?

You clearly don't understand what is meant by quick. Quick is the time it takes to patch the bug from the point it's determined that it exists. As I stated originally no one believes that Linux or any software for that matter is bug free.

Re:Security through Obscurity?

[Anonymous Coward]

Umm, yes... but since the code is open, keeping an exploit "secret" is essentially beyond your control. It also makes it easier for other people to call you on the nature of the flaw, and possibly even draw conclusions about the coding practices that led to the exploit...

Try that with any software built using the 'MS-opacity special sauce.'

PS I use Windows+Cygwin, you can point that that Linux Zealot crap someplace else.

Re:Security through Obscurity?

[atmurray]

Anyone that joins a group called "windows haters" is a fanboy of some other operating system in my book. Windows frustrates me, but I don't choose to go join "windows haters" groups.

Re:Security through Obscurity?

[Anonymous Coward]

"As far as I know, only one OS claims no exploits, and that is OpenBSD."

In the default install... human stupidity is the greatest security risk.

Re:Security through Obscurity?

[mhelander]

"Just because something isn't known doesn't mean someone is trying to hide it."

That's not the point. The reference to obscurity here would resolve into the proposition that the Linux code base is not written clearly enough, regardless of being open source, so that even when you ("you" meaning the trained professional) look at the source, you do not see the bug. Alternatively, the bug was easy to spot but nevertheless remained undiscovered because, for some reason, nobody ever looked at that part of the code. Again, the term "obscurity" would apply for the situation having caused the bug to go unnoticed.

If not "obscurity", then what, exactly, prevented the discovery of this bug in code that has been open for all to look at for 8 years?

Re:Security through Obscurity?

[ammorais]

You call my behavior child-like and yet it's you that had the trouble to try to look up my info on the net to make any kind of weird point. You are crossing some line you know.
I'm sorry that my English is not so sophisticated like yours, but try to express yourself in Portuguese. I'm sure you will sound more than childish. Is my bad English or confrontational behavior excuse for you to be an asshole.
Yes. I think I've wine the right to call you an asshole with the succession of personal attacks that you've made to my person. How much does this sound childish to you?

I really did suspect that I couldn't have a proper conversation right from my first response to your comment, and I should have stopped there, so this is really my fault.
Yet I'm learning with assholes like you, not to respond to comments that have nothing more than being condescending to prove their point.
Good day.

Re:Security through Obscurity?

[Anonymous Coward]

"Don't pick up guys that you don't know on the net with personal attacks"

I second this - it is a lousy tactic that rarely seems to get me laid. Plus, when it does work, the unknown guys you DO manage to pick up are so often disappointing....

"since English is not my first language"

You did say this, so I am sorry. Just couldn't resist.

Re:Security through Obscurity?

[digitalunity]

This is really an ignorant comment about security.

Just because you trust yourself, the only user doesn't mean you can trust all your software. If you typically use a user account and you unintentionally run a piece of malicious software, it should have the ability to destroy your user data at the most.

Local privilege escalations are very dangerous because thats how rootkits get injected.

Re:Security through Obscurity?

[malevolentjelly]

You clearly don't understand what is meant by quick. Quick is the time it takes to patch the bug from the point it's determined that it exists.

How do you know when Microsoft plugs a bug in the Windows platform? Do you keep track of their internal repository? What matters is when the patch gets to the users of the system, not some bleeding edge repository. It's still not in the hands of Linux users. If it gets there in less of the time than Microsoft can push a patch out for their platform, then it's faster. It being in the bleeding edge repository is meaningless.

Re:Security through Obscurity?

[shutdown -p now]

Try this one: 'No. Because it's a freaking LOCAL EXPLOIT and nearly no-one uses Linux for multi-user systems now that everyone can afford their OWN FREAKING COMPUTER.'

So what you're saying is that Linux is effectively as secure as Win9x (which also didn't have any local account security), and that's good enough?

Do you understand the concept of unprivileged user accounts? The purpose of "nobody" user account? The reasons behind the idea of running each service in its own account with minimal privileges? The idea of browser sandboxing?

Re:Security through Obscurity?

[Anonymous Coward]

Is this like some kind of (biological) virus that might just be out there, wreaking havoc and killing people, even though there's absolutely no evidence of such a virus? That makes no sense at all.

There is some evidence that AIDS has been around for 50+ years, but was so rare that no one noticed.

Infectious diseases often increase at exponential rates, but AIDS didn't hit the big time until the 1980s when it made its way into high-risk populations (IV drug users and people who have unprotected sex with many people) when the transmission rate soared.

Re:Security through Obscurity?

[Anonymous Coward]

And unless programmers are magically endowed with omniscience, you need to KNOW ABOUT A BUG before fixing it.

True. But you can also design things to mitigate a bug, prevent its exploitation, or reduce the likelyhood of a bug in the first place.

You can run your website in a firewalled DMZ, with the database, web server, app server all running as separate low-permissions processes that are restricted in what they can do and can only communicate with each other by narrowly defined APIs.

Re:Security through Obscurity?

[Tubal-Cain]

I think he mean obscure in the same way that Haiku, RISC OS, and OS/2 are obscure: few people run it, so even less look to exploit it.

Re:Security through Obscurity?

[quickOnTheUptake]

No. Security through obscurity refers to intentionally implementing a system that whose design is hidden and convoluted (hard to reverse engineer or guess) in order to provide security. It doesn't mean simply not realizing an vector exists.
Storing my financial numbers on a public computer under something like /var/cache/www/.98cf4b2101d would be security through obscurity: I know that anyone with access to the computer could read it, but I'm counting on them (a) not finding it and (b) not having a clue what it is and not opening it if they do.
Of course security through obscurity isn't wrong in itself if properly used especially in conjunction with other more rigorous forms of security.

Re:Security through Obscurity?

[Bandman]

Ducktails the movie.

I remember that. It was a good one.

Re:Security through Obscurity?

[Anonymous Coward]

well, the problem is, the blackhats don't bother with the source to find holes most of the time, it is too annoying (well, I sure hope, but I am sure we still have a few morons that check in code following the obvious patterns that people look for to root out uninitialized data use, not to mention whomever receives the Covery scanner reports and sit on them instead of immediately patching them all or forwarding them to people who would).

Instead, you use automated fuzzing tools to attack the syscalls, network layer, etc. And guess what, those techniques work just as well in *ANY* OS, from Windows, to Cisco's IOS. when a syscall crashes in nice ways, you can look at the source, or you can just look at the crash dump to find out what was derreferenced, poison it, and profit. It is that simple.

So the added damage done because they can easily see inside is very little.

Re:Security through Obscurity?

[Bent Mind]

About a week ago, I updated to kernel 2.6.30. One of the options that showed up describes itself thus:

CONFIG_DEFAULT_MMAP_MIN_ADDR: This is the portion of low virtual memory which should be protected from userspace allocation. Keeping a user from writing to low pages can help reduce the impact of kernel NULL pointer bugs.

Unless I am misunderstanding, or the bug is in this code, the Linux kernel is already protected if properly configured. The kernel already prevents this attack.

Re:Security through Obscurity?

[Anonymous Coward]

> Theoretical nefarious hackers who discovered the flaw before Travis and Julien would have been trying to hide it.

That doesn't work as well as you might suppose. They have to use it for it to be worth anything to them.

And every time you use an exploit, there's a chance of it being caught and discovered by security auditors.

This goes double when you realize that people who have information worth protecting also usually hire people good enough to protect it.

Re:Security through Obscurity?

[micheas]

From the article the article references:

This issue could be mitigated by three things:

     

• the recent mmap_min_addr feature. Note that this feature has known issues until at least 2.6.30.2. See also this LWN article.
       
• on IA32 with PaX/GrSecurity, the KERNEXEC feature
         
• not implementing affected protocols (aka, reducing your attack surface by disabling useless stuff):PF_APPLETALK, PF_IPX, PF_IRDA, PF_X25, PF_AX25, PF_BLUETOOTH, PF_IUCV, IPPROTO_SCTP/PF_INET6, PF_PPPOX, PF_ISDN, but there may be more

So the file server behind a firewall that I have that uses appletalk is vulnerable, otherwise I don't think I am vulnerable, If I find some exploit code I will try it though, just to make sure.

Maybe the issues is that most servers don't use those protocols, and desktops are not as fully audited.

Re:Security through Obscurity?

[caller9]

Ditto shorter resolution. Also, if you had a skilled staff, you fix it yourself.

How many MS ATL apps are you running that are hackable?

How many vendors can update their product on your box without you running a separate update "daemon" in your HKLM/Software/Windows/Run key. Which shouldn't really even work anyway if your smart enough to leave your users out of the admin role. They aren't exactly benifiting from that WSUS server either.

Hell MS released a metric shit-ton of updates. How many MS ATL/Visual C++ apps are now hosed? You will never know, by design.

Re:Security through Obscurity?

[stabiesoft]

I'm still pretty happy with using linux. I have one laptop I boot to windows maybe once a month for skype. Otherwise my 11 boxes and laptops all run linux or solaris. I've never been p0rn'ed yet. So yeah, I feel pretty good still. My friends who run windows would only dream of my level of reliability and they have no web server or email server facing the internet. Enjoy your one day. I've enjoyed my 28 years of *NIX.

Re:Security through Obscurity?

[malevolentjelly]

I'm still pretty happy with using linux. I have one laptop I boot to windows maybe once a month for skype. Otherwise my 11 boxes and laptops all run linux or solaris. I've never been p0rn'ed yet. So yeah, I feel pretty good still. My friends who run windows would only dream of my level of reliability and they have no web server or email server facing the internet. Enjoy your one day. I've enjoyed my 28 years of *NIX.

What is this, an informercial? After 28 years, I can just write you off as certifiably insane and suffering from UNIX Stockholm Syndrome, aka Helsinki Syndrome.

Re:Security through Obscurity?

[Jherico]

Biological viruses don't act with intent. An exploit will, in the sense that it was designed and would typically have a motivation to conceal itself.

Re:Security through Obscurity?

[Anonymous Coward]

OpenBSD is doing even better, masturbating monkeys or not.

That's the most original description of Theo and his team I've ever seen!

Re:Security through Obscurity?

[raju1kabir]

Limited accounts are a Windows NT feature. Are you talking about DOS-based Windows? And Linux doesn't offer the sort of security UAC does. You can't casually SUID 0 past UAC with limited access.

Geez, I hope nobody invents selinux and makes it a 15-second installation process on major distros. Oh wait.

Re:Security through Obscurity?

[the_womble]

The transparent thing works both ways... it's easier for black hats to find holes too, by your own logic. And they can keep it secret and exploit it as long as they can.

Except that there have been leaks of Windows source code. That means the bad guys get to see the source, but the law abiding do not.

Re:Security through Obscurity?

[malevolentjelly]

Geez, I hope nobody invents selinux and makes it a 15-second installation process on major distros. Oh wait.

Ha... oh dear. You really think you're little Mandatory Access Control profile is going to protect you from an suid-based attack by something like ALSA or your wonky networking layer? It's just security retrofitting, it won't protect you from your own shoddily written kernel.

Re:Security through Obscurity?

[CBravo]

If your box is black-hacked for 8 years, and you don't know about it, you have other security problems.

100% unhackable systems don't exist. You have to keep checking for intrusions. There is an entire industry around that.

Re:Security through Obscurity?

[heffrey]

Well there was an eight year wait to fix this one and nobody knows whether or not it has been exploited over that time.

I guess the famous "many eyes" were busy doing something else rather than looking in the source code for bugs like this.

I hope that the steady stream of security problems with open source software will put an end to all the tedious ms hate here on slashdot. Perhaps I'm being a tad optimistic though 'cos faith does seem to blind one from reality.

Re:Security through Obscurity?

[noname444]

Obscure?

This bug was found by a google security team, and this was possible since they (and everyone else) has full access to the Linux source code.
Windows on the other hand is a closed source operating system. It might have (and has) tons of undiscovered bugs that would be easier to spot and remedy if people like google, IBM, you or me had the source code for it. Microsoft's stance is that their operating system is safer if no one has the source code for it. That is the very definition of security through obscurity.

http://en.wikipedia.org/wiki/Security_through_obscurity

You can argue all day which one is more secure, windows or Linux, but saying that Linux uses security though obscurity is simply uneducated.

Re:Security through Obscurity?

[u38cg]

Yeah, so did mine. It's wierd.

Re:Security through Obscurity?

[maxwell demon]

I do not believe that it's possible to fix a bug without knowing about it.

I disagree. You can accidentally fix a bug you didn't know about, e.g. by replacing the algorithm whose implementation was buggy with another algorithm, which you implemented correctly.

Re:Security through Obscurity?

[micheas]

And the system has one of the following modules loaded or compiled into the kernel :PF_APPLETALK, PF_IPX, PF_IRDA, PF_X25, PF_AX25, PF_BLUETOOTH, PF_IUCV, IPPROTO_SCTP/PF_INET6, PF_PPPOX, PF_ISDN,

or /proc/sys/vm/mmap_min_addr does not equal 0

Only two of my systems were vulnerable before being patched.

Re:Security through Obscurity?

[Anonymous Coward]

calm the fuck down

Re:Security through Obscurity?

[Dude McDude]

WTF? When did Linux get infested with idiot fanboys?

October 20, 2004.

Re:Security through Obscurity?

[Anonymous Coward]

Actually, _any_ of the unix-like operating systems - FreeBSD, NetBSD, OpenBSD, OSX or Solaris - is doing much better than Linux in terms of security. Exploitable holes leading to privilege escalation in Linux kernel surface several times more often than in any one of those five.

Re:Security through Obscurity?

[petermgreen]

Try this one: 'No. Because it's a freaking LOCAL EXPLOIT
Remember what "LOCAL EXPLOIT" means, it means anyone who can run code on the machine as an ordinary user can exploit it. Not that they need physical access or anything like that

and nearly no-one uses Linux for multi-user systems now that everyone can afford their OWN FREAKING COMPUTER.'

I see a couple of issues with that statement.

1: While computers are cheap enough rackspace with reliable power, and fast reliable internet links isn't, so very often servers are shared. Being able to run cgi scripts or similar is quite sufficiant to exploit an issue like that.
2: The vulnerability can be combined with other vulnerabilities to make something that is far worse than either would be alone. Combine a remote nonprivilaged code execution vulnerability with a local root vulnerability and the combination is effectively a remote root vulnerability.

Re:Security through Obscurity?

[petermgreen]

Then again, maybe due to the fact that this has the kernel executing said code, its not a userland issue after all. The real problem (apart from the NULL==0 thing) is that a userland app managed to put code at position 0 of the kernel space in the first place.
Some operating systems (linux does and i'm pretty sure windows does too, not sure about others) use a design where the user processes address space remains mapped during calls into the kernel. The kernel address space is then placed at a different location (linux typically uses 0-3G for the userland app and 3G-4G for the kernel) and is always mapped but made inaccessible when in usermode.

This design makes kernel/user modeswitches much simpler and faster and makes it much easier for the kernel to read the parameters it is passed by userland applications. Unfortunately if the devs get things wrong it can open up classes of security holes that would not be possible in a model with completely seperate address spaces.

P.S. there was a patch to linux to make it use completely seperate kernel/user address spaces (the goal being to let user apps use more memory at the cost of performance). I've no idea if it is still curent though.

Re:Security through Obscurity?

[msouth]

A similar bug existing in Windows doesn't prove anything and is irrelevant here. After all 'M$ can't code shit'. Linux and FOSS is commonly claimed to be more secure because of it's development model and bug free here in these parts

Can you show me some (high-modded, preferably) comments that claim linux is bug free?

Re:Security through Obscurity?

[Anonymous Coward]

And that Windows exploit had been around since Win2K SP4 (a very long time), old bugs aren't that uncommon in any OS, the important thing is that they get fixed rapidly once they get discovered.

Re:Security through Obscurity?

[Anonymous Coward]

Hmm. I won't go into details on in how many ways the above can't be used as reliable figures. I'll just point out that it can't. Good grief... Or as you put it: Sigh.

Re:Security through Obscurity?

[theskipper]

Those queries should yield a higher result for Windows since the market share of Windows is so much higher than anything else (i.e. desktop). In other words, after the 20th result page the content will dissolve into any content that discusses Windows with the keyword "hosting" mixed in. Not necessarily "Windows hosting", same applies for the "linux hosting" results. Quoting "windows hosting" and "linux hosting" yields around 1.3m results each.

Regardless, imo the hypothesis of using Google to measure "windows hosting" vs. "linux hosting" is flawed to begin with. Netcraft have been the better tool since its purpose is to measure exactly what you're looking for:

http://news.netcraft.com/archives/web_server_survey.html

Note that the possibility exists that there are more *sites* (domains) sitting on top of the Windows servers even though IIS has a lower market share among web servers than Linux. For example, when Godaddy changed their parking servers to IIS a few years ago.

But these days most Wordpress sites sit on top of a Centos-based VPS, or via Blogspot, etc. which are all running Apache. Lastly, as an empirical check, most hosting companies (Hostgator, advertisers on Webhostingtalk, etc.) have a Linux based package as their default. Windows is available but tends to be more of an option. Perhaps this is more due to cost/licensing issues, I don't know the economics involved.

Re:Security through Obscurity?

[spun]

Sorry champ. I'm not actually a grumpy old curmudgeon, but I play one on the Internet. Now get off my lawn!

Re:Security through Obscurity?

[Anonymous Coward]

This is news because the majority of linux installations go unpatched for years due to penis stroking uptime.

Re:Security through Obscurity?

[Anonymous Coward]

Lame. I once found some guy's full name (first, last, & middle initial), age & astrological sign, picture, occupation, OS and web browser of choice, high school and college, marital status, social networking pages, home address, favourite pizza joint, and that he donated $256 to Ron Paul's campaign in '08... from nothing more than his username.

Re:Security through Obscurity?

[alexborges]

How can they all be rootkitted if its a local root exploit, not a remote one.

How about that. Have you caught it yet?

Re:Security through Obscurity?

[amorsen]

That's the most original description of Theo and his team I've ever seen!

No it isn't, I blatantly stole it from Linus Torvalds...

Re:Security through Obscurity?

[Anonymous Coward]

I disagree. You can accidentally fix a bug you didn't know about, e.g. by replacing the algorithm whose implementation was buggy with another algorithm, which you implemented correctly.

Did you hear that pop? That was my head exploding.

Re:Security through Obscurity?

[Anonymous Coward]

"like is done on things like the space shuttle"

I think you need a better example.

"just being open source doesn't mean it's secure."

No, it just guarantee's that bugs like this are found - eventually. Perhaps that timeline is too long for you, but just imagine what the situation with MS is - more code, more junior people "patchworking" fixes etc etc. Look at what happened to Solaris when it was opensourced:

http://blogs.sun.com/BVass/entry/the_no_1_reason_to

Re:Security through Obscurity?

[badkarmadayaccount]

Hardware anything - slower than software?
YOU'RE DOING IT WRONG!

Re:Security through Obscurity?

[molo]

Which goes to the original point: "Generally people don't care about local privilege escalation on Windows."

-molo

I don't get it...

[Anonymous Coward]

Why the bloody hell isn't page 0 hard-wired to panic the kernel / SIGSEGV the userland when accessed?

Re:I don't get it...

[Anonymous Coward]

I think it qualifies as an oops, not a panic. Regardless I don't get how/why can you map and write to the first page.

Re:I don't get it...

[Anonymous Coward]

I think virtualization blurs the lines where memory addresses should be, and it is not in the scope of the kernel to deal with mapping to 0. Also see physical address extension.

Re:I don't get it...

[JohnFluxx]

Actually, it does... but.. selinux overrides that protection (if its installed).

It's somewhat ironic that this is only exploitable if you have selinux running.. (afaics)

Re:I don't get it...

[Bill, Shooter of Bul]

No on both counts. Linux allows it and its not limited to SELinux enabled kernels.

Re:I don't get it...

[Willbur]

Or someone could prove it doesn't happen in their kernel...

http://tech.slashdot.org/story/09/08/13/0827231/Worlds-First-Formally-Proven-OS-Kernel

Re:I don't get it...

[0123456]

It's somewhat ironic that this is only exploitable if you have selinux running.. (afaics)

AFAIK it's not SELinux, it's poorly-designed SELinux policies which allow any process to map pages at address zero even if they're not root or not otherwise allowed to do so.

Re:I don't get it...

[Anonymous Coward]

Then you have a local DoS.

The point is, just fix the bug and you have no problems.

Re:I don't get it...

[Anonymous Coward]

By default the zero page is unmapped to userland. However, some programs (like dosemu) need to be able to map memory there to operate. Newer versions of linux allow the administrator to control whether to permit these types of mappings (and RHEL5, for instance, does disable them by default).

Re:I don't get it...

[rabtech]

Indeed, on Windows NT based kernels page 0 is always mapped as inaccessible for this very reason and any attempt to access it terminates the offending program (or BSODs if you are in kernel land).

A crash isn't good, but it is certainly better than a root exploit.

Re:I don't get it...

[Anonymous Coward]

Why the bloody hell isn't page 0 hard-wired to panic the kernel / SIGSEGV the userland when accessed?

The first 1024 bytes are the real-mode interrupt table, and the next 256 bytes are the BIOS Data Area. Both of these are used by BIOS interrupts. Linux doesn't generally use the BIOS, but it might have to in some cases (e.g. using INT 10h to set graphics mode if there is no driver for the video card).

Does Linux leave page 0 unprotected so it can use V86 mode to call BIOS interrupts? I don't know; it's just a guess.

Re:I don't get it...

[Anonymous Coward]

Because people needed to run shitty crap like DOSEMU and Wine. And some idiots use low pages in their programs for the weirdest reasons. So, no matter how much we screamed for that hole to be closed, it wasn't for a long while... until Linus got pissed off and closed it without taking any comments from anyone, not allowing even SELinux policies to undo it.

So, latest 2.6.30 and 2.6.27 simply outright refuse non-root access to map page 0 (and a lot more if you have any brains and tell the kernel to lock down the first 4096 pages, which pretty much hoses almost every latent bug the kernel would have, 4k being a very magic number...). Therefore, you already have to be root to use Wine or dosemu... or to exploit this new bug, *if* you are running the latest kernel.

Now, let's see if the distros will backport the disallow page 0 fix and enable it, or if they will preserve the useless ability to run dosemu and wine as non-root (just run windows in a VM, or drop any crap that needs windows to begin with. Dosemu is only used for games, so it matters even less).

Re:I don't get it...

[Bent Mind]

Well.. maybe. Or Maybe not. But Definitely not sort of.

The Linux kernel provides CONFIG_DEFAULT_MMAP_MIN_ADDR to protect against kernel NULL pointer bugs. However, this protection can be disabled via /proc/sys/vm/mmap_min_addr or overridden by an add-on security policy, such as SELinux. The Linux kernel does protect page 0, unless it is configured not to.

Re:I don't get it...

[pjt33]

I've just catted 65536 to mmap_min_addr to replace the previous value of 0. I presume that the previous value was the default compiled into the kernel, and that my distro (Debian stable) won't change that default. I have no desire to compile my own kernel, but I don't want to lose the protection when I reboot after installing the new kernel.

Is the best way to stay safe within those constraints to add a script to init.d referenced by all of the rc*.d to redo the cat? I did try Googling it but I'm mainly getting dosemu and wine bug reports.

Re:I don't get it...

[greed]

There's a good argument for having page zero stuffed with zeros, execute-prohibited and write-prohibited but allow reads. It's got to do with pipelines and test operations.

test cr0,r3
load r4,(r3)
bz .L1,cr0
...do something with r4...
.L1:
...and so on

(Any relation to some weird cross combination of MC68K, POWER, PowerPC, and SPARC assembly is entirely likely.)

So, on some systems, it's worth starting the load through a null pointer before the test of the pointer has completed. AIX on POWER and PowerPC, for example, guarantees that Page Zero is mapped read-only and contains only zeros (which is also an illegal instruction). This way, the pipeline stalls are minimized; if you didn't have anything else to do in that subroutine, you'd have an effective nop after the test, like so:

test cr0,r3
nop
bz .L1,cr0
load r4,(r3)
nop
...do something with r4
.L1:
...and so on

This applies to READ operations only, of course; WRITE operations must verify the pointer, as a write attempt to page zero will fault.

So, Linux: Why is page zero modifiable from userland? A program specifying a load address of zero MUST be rejected.

Re:I don't get it...

[Anonymous Coward]

huh? why would you panic the kernel exactly? next up, a DoS attack in which all linux kernels are vulnerable.

Re:I don't get it...

[Ed Avis]

I believe that for compatibility with old binaries built for crusty i386 Unix variants, a userspace process can choose to map the zero page. That then causes all sorts of problems such as this one.

Summary's Useless link

[Anonymous Coward]

Here's the real one- linked from (mostly) useless article.
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html

I can hear the OpenBSD users laughing already...

[thenextstevejobs]

Or I would be able to, if there were any

The REAL impact here

[mcrbids]

Within a few days, patches will be released to all the OSS vendors. Admins will be inconvenienced by a reboot.

In my case:

# yum -y update && shutdown -r now;

*Yawn*

Re:The REAL impact here

[Anonymous Coward]

That's assuming nobody else has known about it for some time already.

Re:The REAL impact here

[dissy]

Within a few days, patches will be released to all the OSS vendors. Admins will be inconvenienced by a reboot.

Even that last bit is avoidable, if you have Ksplice installed :D

Re:The REAL impact here

[Bazman]

How can you trust that a user hasn't used a privilege escalation to install a rootkit already? You can't trust apt-get, or yum, or anything.

Fresh install time, surely? Back to the bare metal.

Re:The REAL impact here

[Greyfox]

I don't have any users. And corporate IT thinks security means forcing users to change their passwords every couple of months. Most of them will probably wait for scheduled down time to update their kernels, assuming they do it at all.

Re:The REAL impact here

[Anonymous Coward]

How can you trust that a user hasn't used a privilege escalation to install a rootkit already? You can't trust apt-get, or yum, or anything.

Fresh install time, surely? Back to the bare metal.

Or, just boot off a CD and do some MD5 hashing. For extra paranoia take the disk out to avoid the chance of a rootkit in the bios.

Re:The REAL impact here

[mcrbids]

How can you trust that a user hasn't used a privilege escalation to install a rootkit already? You can't trust apt-get, or yum, or anything.

How do you know that the CD image doesn't contain hacked software?

How do you know that the compiler hasn't been hacked in with a hidden precompiled message?

How do you know that the website with the MD5 summaries isn't a Man-In-The-Middle?

At some point, you have to take a good look and decide that it's good enough. And the "compromise" position that you have to take with Linux is sooo much more secure than the Windows alternative. True, I don't know for *sure* that no local users have compromised the systems. But then, I never do, truthfully, anyway. But I do have some pretty strong assurances, and that's good enough for almost anyone.

Re:The REAL impact here

[Entropius]

Depends on what machine you're talking about.

The login nodes at ranger.tacc.utexas.edu? They probably need to be checked pretty carefully (which might wind up being a royal pain for the users).

My eeepc? Probably not such a big deal. Patch it, and if it starts acting funny, then get worried.

Re:The REAL impact here

[rjstanford]

I don't have any users.

Probably don't need to install the patch then. Or keep the machine powered on, for that matter...

Re:The REAL impact here

[alexborges]

Dont be a dumbass, really. If "someone" knows about it, "they" did not release an exploit to the wild or we wouldve known it sooner.

Re:The REAL impact here

[ClosedSource]

Is that because so many linux users scan their computer daily with anti-virus software?

Re:The REAL impact here

[alexborges]

HUH?

Well we do have good antivirus to protect all those windows from becoming bots.

Virus, in our case? What would the infection vector be?

Can you cite one? Where is that mean oo.o killer macro virus that turns our boxes into spambots?

Its plain simple: Linux is WAY more secure than ANY windows incarnation. Period.

Re:The REAL impact here

[Exception Duck]

You must be mistaken. rjstanford is the computer.

Re:The REAL impact here

[ClosedSource]

I was just responding to your claim that they "did not release an exploit to the wild or we wouldve known it sooner."

How exactly would you have known?

Re:The REAL impact here

[BhaKi]

These days, there are BIOS-based root-kits too. So 'back to bare metal' can't be the 100% trustable solution.

Re:The REAL impact here

[xtracto]

How can you trust that a user hasn't used a privilege escalation to install a rootkit already? You can't trust apt-get, or yum, or anything.

How do you know that the CD image doesn't contain hacked software?

How do you know that the compiler hasn't been hacked in with a hidden precompiled message?

How do you know that the website with the MD5 summaries isn't a Man-In-The-Middle?

At some point, you have to take a good look and decide that it's good enough. And the "compromise" position that you have to take with Linux is sooo much more secure than the Windows alternative. True, I don't know for *sure* that no local users have compromised the systems. But then, I never do, truthfully, anyway. But I do have some pretty strong assurances, and that's good enough for almost anyone.

All those simple problems were solved 10 years ago.

It is just a matter of downloading/printing/reading/compiling/done.

Oh, and yeah, I made my own compiler in assembler (one cannot be sure that those binary compilers do not inject bad code to the a.out !)

Re:The REAL impact here

[DrWilken]

Exactly... :) I got the fix for this even BEFORE reading about this... :) Ksplice is a "must have" IMHO... :)

Re:The REAL impact here

[alexborges]

Yep.

In this you are right. No way to magically know.

But there IS one thing: this is not wildly exploited. There is no spamclowd spawning from this bug. Yes, if there was one, there is a good chance that the community that manages thousends of linux boxes wouldve been negatively hit and yes, a good chance we would know.

Of course, a lone or silent group, that we cannot catch magically. You are right in that part.

Re:The REAL impact here

[The_mad_linguist]

>How do you know that the CD image doesn't contain hacked software?
Diffed three CDs of the same thing from widely disparate sources

>How do you know that the compiler hasn't been hacked in with a hidden precompiled message?
Get the source code for a C compiler in COBOL. Pick up ten different COBOL compilers from widely disparate sources. Put the compiler in the compiler, and get ten outputs. These should all function exactly the same, even if they aren't bitwise identical, so get the code for ten different C compilers written in C. Run each of them through your ten compilers. If the output on each is identical, then you can be sure that either
A) All the compilers you have are safe
B) Every compiler on the planet is hacked in exactly the same way, and has been for decades, in which case you're screwed no matter what you do, so it doesn't matter.

>How do you know that the website with the MD5 summaries isn't a Man-In-The-Middle?
Check from five different computers accessing the internet through different methods. Compare your ping times. Use good crypto.

Well.

[gbarules2999]

That's not good at all.

(from the blog)

[An anonymous Frank]

In the Linux kernel, each socket has an associated struct of operations
called proto_ops which contain pointers to functions implementing various
features, such as accept, bind, shutdown, and so on.
If an operation on a particular socket is unimplemented, they are expected
to point the associated function pointer to predefined stubs, for example if
the "accept" operation is undefined it would point to sock_no_accept(). However,
we have found that this is not always the case and some of these pointers are
left uninitialized.
This is not always a security issue, as the kernel validates the pointers at
the call site, such as this example from sock_splice_read:
[snip]
But we have found an example where this is not the case; the sock_sendpage()
routine does not validate the function pointer is valid before dereferencing
it, and therefore relies on the correct initialization of the proto_ops
structure.
We have identified several examples where the initialization is incomplete:
[snip]

Local Privilege Escalation On All Linux Kernels

[sofar]

sudo

Please, this is a _local_ privilege escalation. It's not like code red infecting your box remotely. A sledgehammer is also a local privilege escalation.

Re:Local Privilege Escalation On All Linux Kernels

[thenextstevejobs]

Please, this is a _local_ privilege escalation. It's not like code red infecting your box remotely. A sledgehammer is also a local privilege escalation.

Log in as an unprivileged user on a shared server remotely with a sledgehammer then. Oh wait..

Re:Local Privilege Escalation On All Linux Kernels

[jandrese]

The thing is, local privilege escalations can become remote privilege escalations when combined with buggy services that allow for code injection. This is especially bad for people who are forced to run services that they don't trust and thus place them in jails, only to discover that if the exploit happens at the kernel level then your jail means nothing.

My guess is that rootkits are being updated as we speak, so get your kernels patched people.

Re:Local Privilege Escalation On All Linux Kernels

[FudRucker]

maybe ssh or nfs ???

Re:Local Privilege Escalation On All Linux Kernels

[athakur999]

But if you have any programs that access the Internet that have a bug that allow running arbitrary code, couldn't a remote cracker could exploit the vulnerability in that program to invoke this bug, and through that gain root access to the machine? It sounds like the program being exploited could even be running as a regular user.

Re:Local Privilege Escalation On All Linux Kernels

[quarterbuck]

A sledgehammer is a Denial of Service - Unless you aim it at the head of the operator and threaten to use it.

Re:Local Privilege Escalation On All Linux Kernels

[Anonymous Coward]

Actually I think OpenSSH will support that soon.

Re:Local Privilege Escalation On All Linux Kernels

[jhol13]

sudo

Again? Second time this year?

And I have had sooo many complaints when I have kept KISS - su is several orders of magnitude simpler (no configuration files to fubar either).

Re:Local Privilege Escalation On All Linux Kernels

[oxfletch]

Surely a sledghammer, whilst local, is not a privilege escalation?

Re:Local Privilege Escalation On All Linux Kernels

[rjstanford]

Surely a sledghammer, whilst local, is not a privilege escalation?

Depends. Some guy holds a sledgehammer over my jewels and wants me to call him "Sir," I'll probably oblige, at least while he's got energy of position over me. And I'm not even military!

Re:Local Privilege Escalation On All Linux Kernels

[AigariusDebian]

su requires you to give a shared password to multiple administrators. With su you can not give a group of people an ability to run a certain command as a different specific user. Sudo is much simpler to the end user - they only need to remember one password. Very much a KISS.

Re:Local Privilege Escalation On All Linux Kernels

[sofar]

most (if not any) remote attackers don't even bother to become root, they happily run their zombie / bots as an unprivileged user.

Re:Local Privilege Escalation On All Linux Kernels

[cenc]

This is easily used as a remote exploit from the looks of it. Someone correct me if I am wrong here. Some of the new linux users are likly getting the impression you need to be physically sitting at the machine.

Say you have virtual server somewhere as is common to most low end VPS hosting companies with linux running on it with a reseller account. What is there a few million of these or more around the World likly?

You have given clients ssh access to use sftp. So, they have limited local user rights, if they are not properly jailed.

In theory then this is part of a remote exploit on certain systems that will give elevated privileges.

Am I right about this?

Re:Local Privilege Escalation On All Linux Kernels

[Deanalator]

Um, you realize you can search google for hundreds of thousands of vulnerable webapps right? Those web apps will quickly give up a user shell, which can now be escalated to a root shell. Now that box can log ssh, arp poison the local network, and soon take over the data center.

Also, universities give out shells to all students, and professors are often given shells at large corporations and government research labs. Hosting companies give shells to anyone willing to pay a few dollars. Anyone who thinks that local root exploits are not a big deal is completely insane.

Also take into consideration the recent SSL bugs, and that almost none of the popular corporate VPN clients have been updated yet, so if anyone from your company has been by an airport in the past couple weeks, you undoubtedly have a number of attackers inside your corporation already. With proper scanning, local escalation, and rootkits, they will be there for as long as they feel like it.

Re:Local Privilege Escalation On All Linux Kernels

[Johnno74]

A sledgehammer is also a local privilege escalation.

Actually, I'd class a sledgehammer as more of a denial of service attack.

Re:Local Privilege Escalation On All Linux Kernels

[evilpenguin]

In which case it would have to be called "social engineering."

Re:Local Privilege Escalation On All Linux Kernels

[jhol13]

su requires you to give a shared password to multiple administrators.

Not 100% true - you can make user "toor" with uid 0 (I admit this is not very good solution).

With su you can not give a group of people an ability to run a certain command as a different specific user.

I consider this a good thing: almost every program known to man will give you full root permissions this way (unless you mean "su userX"). False sense of security ...

KISS does not necessarily mean simple to user - or running everything as root would be considered KISS. I do not consider that "simple" (though it is, in different sense, stupid).

Re:Local Privilege Escalation On All Linux Kernels

[lintux]

Although I'm tempted to say calling it "brute force" would be more accurate. :-)

Re:Local Privilege Escalation On All Linux Kernels

[ShOOf]

No.

Local means that you have to have shell access to the machine in order to run the exploit. SSH allows you to have shell access "remotely" but that is not a remote exploit. This still requires shell access and that is not something that should be given to users unless absolutely necessary, if you are enabling sftp access and not locking down the shell then you've already failed.

Re:Local Privilege Escalation On All Linux Kernels

[Innova]

No. A sledgehammer would be a local denial of service.

Re:Local Privilege Escalation On All Linux Kernels

[Anonymous Coward]

Here's a little tip for all those who jail: they have to run the code locally to get anywhere..... why would you ever let a user trapped in a jail run code? Trusted path execution + some ACL workage = an effective chroot jail. grsec provides something similar I believe.. This'll stop them kiddies. if they leverage the exploit remotely with a stager, then they're simply leet enough to have the rights to own your system.. because that'd be one hell of an awesome piece of code.

Re:Local Privilege Escalation On All Linux Kernels

[sofar]

stop labelling security vulnerabilities as denial of service attacks!

SELinux?

[Shimdaddy]

Is this something that SELinux would protect against?

Re:SELinux?

[thenextstevejobs]

Is this something that SELinux would protect against?

You could put extremely strict policies on your users that would not allow them to write to disk, open sockets, etc. But essentially without crippling your users, the answer is no.

Re:SELinux?

[QuoteMstr]

SELinux makes the problem worse. Without SELinux, there's a variable that specifies the lowest page in memory that a process can map. If you can't put anything at address 0, jumping through a NULL function pointer isn't as big a deal.

With SELinux on, that variable is ignored, and you can map at address 0 to your heart's content.

Re:SELinux?

[Anonymous Coward]

Idiot karma whore.

The summary said all kernels.

Re:SELinux?

[toxygen01]

actually grsecurity can (if configured properly) prevent this This issue could be mitigated by three things: "on IA32 with PaX/GrSecurity, the KERNEXEC feature" RTFA

Re:SELinux?

[Bandman]

From http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html:

-------------------
Mitigation
-----------------------
Recent kernels with mmap_min_addr support may prevent exploitation if
the sysctl vm.mmap_min_addr is set above zero. However, administrators
should be aware that LSM based mandatory access control systems, such
as SELinux, may alter this functionality.
It should also be noted that all kernels up to 2.6.30.2 are vulnerable to
published attacks against mmap_min_addr.

Re:SELinux?

[Anonymous Coward]

First off, I'm not sure it's fair to call SELinux a kernel. I suppose, if you half close an eye and tilt your head you could consider a project that includes linux security modules a separate kernel, I could see your point.

Second, it said "all 2.4 and 2.6 kernels" which I (maybe I'm also an idiot, though) took to mean that kernel 2.6.X.New isn't safe -- it was meant to not except certain versioned kernels.

Third, even if you're right, you're probably (angrily) mistaking noobishness for karma-whoring. Don't be so angry, it was just a question.

Re:SELinux?

[pembo13]

Someone like Dan Walsh would know, check his blogs see if he makes any comments.

Re:SELinux?

[Creechur]

SELinux might actually hurt in this situation, since this is a NULL pointer exploit. The LWN article Fun with NULL pointers from a few weeks back has an interesting explanation.

Re:SELinux?

[Anonymous Coward]

No, because SELinux is the NSA's backdoor.

Re:SELinux?

[Anonymous Coward]

Since SELinux is relied upon to keep TOP SECRET data from flowing to the Internet, it could not possibly have such a simple flaw. But even if it did, there are no Trojan horses in NetTop type systems, so why worry?

Re:SELinux?

[eparis]

SELinux is currently weaker in this area for local users. It is stronger in this area for remote network facing daemons. See http://eparis.livejournal.com/ for all the details. Blanket statements in either direction on SELinux and NULL ptr exploits are wrong.

Re:SELinux?

[BhaKi]

SELinux makes the problem worse. Without SELinux, there's a variable that specifies the lowest page in memory that a process can map. If you can't put anything at address 0, jumping through a NULL function pointer isn't as big a deal.

With SELinux on, that variable is ignored, and you can map at address 0 to your heart's content.

It is for times like these, that I always disable SELinux as soon as I install a distribution.

World-wide Linux reboot party

[adosch]

Oh how I wish 'ksplice' was more widely adopted in my deployed distro at work...

Re:World-wide Linux reboot party

[thenextstevejobs]

Point made above is that your ksplice could have been owned before you patch.

Re:Soo

[ammorais]

You could bother to read the article.
A patch already was made.
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98

Not quite.

[Anonymous Coward]

I use Ubuntu with Ksplice. Fixing this will be a matter of downloading a new kernel and reloading it. Suck on that Mac/PC users.

Re:Not quite.

[Anonymous Coward]

I fixed it for you:

Suck on that Mac/Win users.

Did you know that Linux can run on a PC?

This is the first time publicized...

[Anonymous Coward]

This is the first time it's been publicized... not discovered.

Patch released

[JacobSteelsmith]

http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html

Linus committed a patch correcting this issue on 13th August 2009. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98

Guys?

[eexaa]

where's the source?! I want to try it. On my box.

Re:Guys?

[Anonymous Coward]

I already tried it on your box - works great!

Re:Guys?

[Anonymous Coward]

http://grsecurity.net/~spender/cheddar_bay.tgz

Guest accounts

[eric31415927]

I wonder how many people are logging into guest accounts right now trying out this "bug."

Re:Guest accounts

[Anonymous Coward]

Seems to work just fine on your box . . .

Re:Guest accounts

[jvillain]

If I had mod points I am not sure if I would mod this up for funny or down for failing to understand what a local exploit is? Good thing I don't have mod points.

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

I am! And I'm a DeadBSD user!

It's from April? Really?

[winkydink]

Then why did Linus check in a patch today to fix it?

http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html

Patch will be out right about...now

[HangingChad]

You could measure it with a stop watch. Pretty rare to find such a serious flaw in Linux.

In other news, I noticed my Windows box automatically restarted last night. Your computer has recently been updated. No kidding.

Re:Patch will be out right about...now

[Anonymous Coward]

Leave it to slashdotters to turn a bug in Linux into a bashing of Windows.

Re:Patch will be out right about...now

[compro01]

You could measure it with a stop watch.

Indeed. Patch was committed 16 minutes after that blog post and 3 hours, 57 minutes before this story hit the front page.

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98

Re:I can hear the OpenBSD users laughing already..

[frn123]

Sure there are. And they are both laughing.

QUICK

[Anonymous Coward]

everyone go hax the internets! rootkit everything!!!

local... remote...

[spun]

As was stated before: if someone has a local account on your Windows machine, they already own you. You DO know the difference between local and remote exploits, right? I mean, NOBODY on Slashdot would go spouting off on topics they know nothing about just to score some points for their favorite OS.

Yeah, this is a serious bug. But honestly, how many people are running real multi-user systems with multiple honest to God local users? Okay, I am, but I figure I'm probably in the minority nowadays.

Re:local... remote...

[Anonymous Coward]

nobody (the apache account) is a local user.

Re:local... remote...

[recoiledsnake]

As was stated before: if someone has a local account on your Windows machine, they already own you.

Citation? And please don't cite 9X/ME or older in the Windows Home line.

Re:local... remote...

[innocent_white_lamb]

how many people are running real multi-user systems with multiple honest to God local users?
 
Businesses, of course. And don't assume that means 500+ employees. If you live a town of more than about 500 people, the local town office is another example.
 
You would be surprised at how many tiny businesses want to have multi-user systems for their operations once someone tells them that it is possible to do that.
 
You mean I don't have to hoof it over to my secretary's desk to pick up that memo? Sign me up!

Re:local... remote...

[Anonymous Coward]

Local exploit in kernel + arbitary code execution exploit in network service = remote exploit.

You know, like running WordPress.

It would be quite an accomplishment to introduce a remote exploit directly in the kernel.

Re:local... remote...

[alexborges]

No no... not "wordpress". Youd need an exploit in the PHP-Apache stack, not just in a random web app.

Care to find us one of those tha tis currently unpatched?

Re:local... remote...

[michaelwigle]

Sure, no problem.

NTPasswd

And, you don't even need a local account. Boot PC off CD and reset the adminstrator account password. The machine is yours. Or, if you only want the unexcrypted data off the HD choose the LiveCD of your choice (like Ubuntu) and click on the hard drive. All file are there and you have full permissions. Replace any one you want. Of course, all of this can be done to a *nix machine too. Fact is, if you have physical access to the machine it's really only a matter of time before you have what you want.

For what it's worth, I've used these tools for data recovery and accessing machines that have been hosed. I've done NTPasswd on XP home/pro and the data recovery in Vista and Win 7.

Re:local... remote...

[RichardJenkins]

Do you mean an exploit to run arbitrary code as the apache user? How is that different from a (presumably improbable) feature bug in Wordpress that allows you to run applications?

Re:local... remote...

[recoiledsnake]

No no... not "wordpress". Youd need an exploit in the PHP-Apache stack, not just in a random web app.

Care to find us one of those tha tis currently unpatched?

Why would a Wordpress exploit be not possible as a vector for this? For example see this --> http://secunia.com/advisories/25794/

If you can run arbitrary PHP code, you could possibly trigger this NULL exploit to get root.

Re:local... remote...

[arndawg]

FAIL! Local explot has nothing to do with PHYSICAL localization. It just means that the hacker needs to run his code on computer as a local user. all the hacker need is an exploit in some software you're using. i.e firefox, flash etc and make you visit their exploit. By hacking your favorite porn site f.ex.

Re:local... remote...

[Anonymous Coward]

As was stated before: if someone has a local account on your Windows machine, they already own you

It was *claimed* before, by an AC giving no examples who started their sentence with 'ROFL'. It's ambiguous enough to mean what you want it to, and completely unsupported. It sounds a bit like you're saying that at any given time on any given Windows machine there are known, exploitable privilege escalation vulnerabilities - I'm not up to date with the Windows world but that sounds ludicrous.

Reading the comments in this bug I can't help but feel some people have a philosophical appreciation for open source which biases them towards supporting it in all cases for non-technical reasons.

Re:local... remote...

[recoiledsnake]

Local account != Physical access. For example, website accounts on hosting sides, shell accounts, in fact any ssh account. So what about referencing real local user exploits for Windows that dont' need local access?

Re:local... remote...

[gd2shoe]

nobody (the apache account) is a local user.

That's not good. The "nobody" account is used for far too much, and should be restricted whenever possible. It's preferable to use a dedicated account for each running service. For example, on Debian, Apache runs as "www-data".

Re:local... remote...

[ignavus]

nobody (the apache account) is a local user.

That nobody guy is really smart.

I often tell people that nobody is smarter than me.

Re:local... remote...

[shutdown -p now]

As was stated before: if someone has a local account on your Windows machine, they already own you.

Either give steps to perform privilege escalation from a local unprivileged user account to administrator on a fully patched WinXP/Vista/7, or provide a link to any source describing such steps, or admit that you're lying.

Re:local... remote...

[Anonymous Coward]

Web hosting companies. They'll typically have a system user for each website, or at least of each client. While most of them don't allow remote logins, they all allow their users to upload and run code. It's typically a scripting language (PHP is probably the most common), but lots of them still allow CGI binaries, and you could still probably exploit this from a PHP-driven webpage.

Add to that the fact that many people are using out-of-date, insecure PHP apps (or even ones that are just poorly maintained, both open source and commercial), which can allow an attacker to execute arbitrary PHP code. Armed with a local root exploit, an attacker can take over not only the user's account, but the entire system as well.

Re:local... remote...

[pclminion]

Remote exploit --> user shell --> local exploit --> r00ted.

Remote exploit + local root exploit == remote root exploit. Always.

Re:local... remote...

[Gr8Apes]

funny, my apache always runs as... apache...
Because why would I not fully control what my service(s) can access?

Re:local... remote...

[maxwell demon]

Don't you want that nobody exploits your machine?

Re:local... remote...

[jonaskoelker]

I broke into nobody's account and took a peek at their files. Look what I found:

$ ls -l
-rwx------ 1 nobody nobody 12542 1000-07-24 12:45 predict_spanish_inquisition

Re:local... remote...

[ivucica]

www-data

Re:local... remote...

[PhilPSU]

Well agian thank you for proving my point and showing me how defensive /.ers get about thier OS. I seen countless systems in my enviroment running as such but I guess there just honest to god users so there safe :). No worries

Re:local... remote...

[spun]

You want me to give away the house? Crikey, man, how much is it worth to you? If you really want to know, just send me your SSN and bank account information so I can transfer my fee.

Re:local... remote...

[palegray.net]

If you can run arbitrary PHP code, you could possibly trigger this NULL exploit to get root.

s/possibly/definitely/

There, fixed that for ya.

Re:local... remote...

[Anonymous Coward]

Ahh yes, the hidden third option: pretend you're a retard.

If only...

[Balial]

If only there was some way to formally verify the correctness of an OS kernel! :)

Re:If only...

[JSBiff]

You know, this brings up a very interesting point. Someone else in this thread mentioned that the problem was either caused or exacerbated by code which was *optimized out of the kernel by gcc*. Your comment about formal verification (which, I realize is an allusion to the article earlier today or yesterday about that Australian uKernel which was formally verified), makes me wonder - does it *matter* if your C code is formally verified, if your compiler can produce output which doesn't match the specified C-code? I hope those Australians turned off all compiler optimizations. . .

Re:If only...

[GargamelSpaceman]

They had that story yesterday, your spec would be as complicated and hard to verify the correctness of as the OS.

Now if we had a Formal specification verifier, we could use a Formal Specification Verifier Verifier to verify the correctness of IT, then use a Formal Specification Verifier Verifier Verifier....

Re:I can hear the OpenBSD users laughing already..

[SevenHands]

Are you sure they aren't laughing because they found some more "edible" gunk between their toes?

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

Hey! =/

Like who found this

[Anonymous Coward]

I like the fact that the two people who found this are from the Google Security..koodo's

Re:I can hear the OpenBSD users laughing already..

[Desler]

Theo and Theo's girlfriend?

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

... I don't get it... Stallman uses Linux...

Some distros less vulnerable by default

[Bandman]

From http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html:

-------------------
Mitigation
-----------------------
Recent kernels with mmap_min_addr support may prevent exploitation if
the sysctl vm.mmap_min_addr is set above zero. However, administrators
should be aware that LSM based mandatory access control systems, such
as SELinux, may alter this functionality.
It should also be noted that all kernels up to 2.6.30.2 are vulnerable to
published attacks against mmap_min_addr.

I have checked my default Ubuntu and CentOS/RHEL boxes, and both of them are set well above 0:

root@Ubuntu:/proc/sys/vm# cat mmap_min_addr
65536

[root@CentOS /proc/sys/vm] cat mmap_min_addr
65536

[root@RHEL /proc/sys/vm] cat mmap_min_addr
65536

Re:Some distros less vulnerable by default

[iggymanz]

on my Debian 5 (Lenny ) it's zero

Re:Some distros less vulnerable by default

[cyphercell]

Looks like the only reason to set this to 0 would have been to run wine. For support of 16bit windows apps.
Correct me if I'm wrong.

http://www.linuxplanet.org/blogs/?cat=408
http://lkml.indiana.edu/hypermail/linux/kernel/0907.2/01466.html
http://lkml.indiana.edu/hypermail/linux/kernel/0907.2/00715.html
http://linux.derkeiler.com/Mailing-Lists/Kernel/2009-07/msg08106.html

Re:Some distros less vulnerable by default

[Anonymous Coward]

I have checked my default Ubuntu and CentOS/RHEL boxes, and both of them are set well above 0:

root@Ubuntu:/proc/sys/vm# cat mmap_min_addr
65536

[root@CentOS /proc/sys/vm] cat mmap_min_addr
65536

[root@RHEL /proc/sys/vm] cat mmap_min_addr
65536

Hah! You think you're secure? Then why are you doing this from a root account? You can cat those /procs as a normal user, you know!

Do you always log in as root? Shame on you, Mr. Secure Box!

Re:Some distros less vulnerable by default

[gfolkert]

Debian Sid running:

greg@maxime:~ [0] $ uname -a
Linux maxime 2.6.31-rc4-686-bigmem #1 SMP Sat Aug 1 08:00:47 UTC 2009 i686 GNU/Linux
greg@maxime:~ [0] $ cd /proc/sys/vm/
greg@maxime:/proc/sys/vm [0] $ cat mmap_min_addr
4096

How is that?

Re:Some distros less vulnerable by default

[Anonymous Coward]

I have checked my default Ubuntu and CentOS/RHEL boxes, and both of them are set well above 0:

Unfortunately, not all Ubuntu are set this way. My Ubuntu Netbook Remix 9.04 has mmap_min_addr set to 0.

Thanks for the info to quickly let me see how vulnerable my machines are.

Re:Some distros less vulnerable by default

[someSnarkyBastard]

and on a Fedora 11 box I get the following: $ cat mmap_min_addr 32768

Re:Some distros less vulnerable by default

[sowth]

dosemu also needs it to be set 0.

Re:Some distros less vulnerable by default

[macshit]

and debian:

$ cat /proc/sys/vm/mmap_min_addr
4096

Re:Some distros less vulnerable by default

[KamuZ]

Ubuntu 8.10 Desktop

Linux XXX 2.6.27-14-generic #1 SMP Fri Jul 24 22:19:33 UTC 2009 i686 GNU/Linux

root@XXX:~# cat /proc/sys/vm/mmap_min_addr
0

Re:Some distros less vulnerable by default

[cyphercell]

So we can blame this on microsoft right? :D

Re:It's from April? Really?

[PopeRatzo]

a severe security flaw in all 2.4 and 2.6 kernels since 2001

April or not, I want to know why it's taken eight years to find this flaw.

Re:Yeah, those windows lusers will just fuck a few

[Anonymous Coward]

beatches while I go compiler a kurnul. I'm so glad I am a linuxtardo.

For crying out loud... learn how to write English, please!

Already patched and ...

[Anonymous Coward]

don't run services you don't need. Why didn't I think of that? Well, none of my systems run any of the services mentioned.
Security starts at the front door and never stops.

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

Theo and Theo's "girlfriend"?

Fixed the for you

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

Ya, because Linux is such a pathetic piece of shit.

Re:It's from April? Really?

[linzeal]

I would love to know if this has ever been used as an attack before this announcement and by who to whom.

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

I didn't know his hand could laugh.

Re:I can hear the OpenBSD users laughing already..

[tres]

There's a theme of comments that occur every time another Windows vulnerability happens. It goes something like this:

Windows FanboiIt doesn't matter. Marketshare marketshare marketshare blah blah business drivel Linux has no marketshare!

It's ironic to now see the Linux 31337 in this meme; trying to redirect from security vulnerability to lack of marketshare by a competing OS.

But I guess maybe it goes along with the whole tired 'BSD is dying' theme.

This reminds me of why I use linux...

[calmofthestorm]

Because we fix it instead of hushing it up until it becomes fairly well known and then waiting a month to fix it.

That said, it's nice to see the occasional vuln in Linux. Helps shut up the fanbois and keep everybody sharp. Because while under many eyes, all bugs are shallow, that only works if the eyes are actually looking.

Re:This reminds me of why I use linux...

[Anonymous Coward]

Yeah I'm sure that pesky socket code hasn't been looked at once in the past 8 years. That bug sure was shallow.

Child labor

[tepples]

'nearly no-one uses Linux for multi-user systems now that everyone can afford their OWN FREAKING COMPUTER.' Good lord, kids these days, gotta teach them everything.

You mentioned kids. It turns out that they can't necessarily "afford their OWN FREAKING COMPUTER." For the entire history of mass-market personal computers in the United States, home of Slashdot, laws prohibiting child labor have been in force.

RHEL is safe?

[neurovish]

It looks like RHEL's mmap_min_addr (cat /proc/sys/vm/mmap_min_addr) is set to 65536 by default. According to the vulnerability posting:

Recent kernels with mmap_min_addr support may prevent exploitation if
the sysctl vm.mmap_min_addr is set above zero. However, administrators
should be aware that LSM based mandatory access control systems, such
as SELinux, may alter this functionality.

So, if you're running stock RHEL 5.3 without SELinux, you should be safe?

Re:RHEL is safe?

[f8l_0e]

Ubuntu 9.04 x64 with the 2.6.28-14-generic kernel also reports mmap_min_addr is 65536.

Re:RHEL is safe?

[JSG]

My Gentoo systems running gentoo-sources report 4096. As SELinux is a bit of a bugger to install I haven't got around to it yet.

Wonder why it is 4096 on Gentoo but Ubuntu and RHEL users are reporting 65536?

Re:RHEL is safe?

[dpilot]

On my hardened (non-SELinux) server, mmap_min=0. On my desktop, there is no mmap_min.

Can I "fix" this by just writing something non-zero to that file in /proc?

What does it mean that my desktop has no mmap_min?

Re:RHEL is safe?

[neurovish]

You are probably running a kernel that does not have support for vm.mmap_min_addr.
I'm not sure when it was added, but I have kernel 2.6.23 on my desktop and don't have it.

Adding it to /proc would do nothing if the kernel doesn't support it.

Re:RHEL is safe?

[Athanasius]

Just having mmap_min_addr and setting it to a page or more above 0 isn't good enough. It also depends very much on the exact kernel version you're running. 2.6.30.2 had a problem with both SELinux and personalities making it possible to get around this. 2.6.30.3 fixed both I believe.

See http://lwn.net/Articles/342420/ for more about which versions are vulnerable and why (and, yes, I'm the same Athanasius linked to in the "This change is not enough for some users, who have requested the ability to turn off the personality feature altogether. " bit, if I could get my arse more in gear I'd have coded up a sysctl/personality patch by now).

Re:RHEL is safe?

[dpilot]

I forgot to mention, both systems are Gentoo, which is why I attached to the GGP.

The server is running hardened-sources-2.6.29-r?, and it has the vmmap_min_addr=0. I was asking if I can simply echo a nonzero value to band-aid around the vulnerability.

The client is running gentoo-sources-2.6.30-r3, and it does not have vmmap_min_addr. I know echoing a value into proc when there's no kernel support will do squat. I'm more wondering why it's missing, since the kernel is new enough. Is it only certain kernel options that make vmmap_min_addr exist?

Re:RHEL is safe?

[t35t0r]

how do i check for this on RHEL4? There's no *mmap* anywhere under /proc

Hide teh Lunix

[tepples]

Seriously, how hard is it for the OS to just blow up whatever program is running if it tries to access the memory location NULL, period?

That depends on whether you're running this OS on a PC or a C64. Programs on a C64 are expected to access memory-mapped I/O registers at $0000 and $0001.

Re:Hide teh Lunix

[aerton]

By C standard, NULL doesn't have to point to the address of 0.

"Many eyes", but all of them nearsighted?

[Petersko]

And from all across the globe came the sound of geeks crying, for they would soon see their beloved "uptime" reset to zero.

Re:"Many eyes", but all of them nearsighted?

[imrehg]

And from all across the globe came the sound of geeks crying, for they would soon see their beloved "uptime" reset to zero.

Except if they are proper geeks, they don't have to reboot to patch kernel, do they? ;)

Re:"Many eyes", but all of them nearsighted?

[AlexiaDeath]

Smart ones wont cry for they have ksplice and their uptime is safe.

Re:"Many eyes", but all of them nearsighted?

[tomtomtom]

Unless they use ksplice

Re:It's from April? Really?

[alexborges]

Oh...

So it was disclosed the 11th of august and linus has a patch today, HUH?

There are YEAR OLD bugs with this exact level of danger that microsoft simply has not patched and still refuses to patch.

Fuck you, I love my os BECAUSE i know beforehand that it will be fixed in no time....

Windows people are just plain stupid, really.

Re:It's from April? Really?

[Verdatum]

Yeah, that was my fault. Sorry about that. I knew it was there, I just kept putting off fixing it or telling anyone.

Not affected

[Tenebrarum]

Just echo something greater than 0 to /proc/sys/vm/mmap_min_addr

Which ya'll should've set during config, anyway.

Local vs. remote

[tepples]

Which part of "local" are you not understanding?

"Local" doesn't necessarily imply physical access. It simply means that you have gained permission to run arbitrary code as a user on the given system. For example, if you have logged into an SSH account that is local to a given machine, you are local. So first you use a remote exploit to gain local privilege, then you use a local exploit to elevate from there.

Re:Local vs. remote

[oxfletch]

To quote:

"then it would have been used against all the servers that support the world's webpages. Wikipedia's Ubuntu servers, for example, or getting deeper, something like Amazon"

You have an SSH account on Wikipedia? Amazon?

Re:Local vs. remote

[tepples]

You have an SSH account on Wikipedia? Amazon?

I used SSH as an example of a service that provides "local access" to a remote server. If one can compromise the running copy of Apache, PHP, or MediaWiki on wikipedia.org, he has the same access as any developer with a shell account.

Re:Local vs. remote

[bill_mcgonigle]

I used SSH as an example of a service that provides "local access" to a remote server. If one can compromise the running copy of Apache, PHP, or MediaWiki on wikipedia.org, he has the same access as any developer with a shell account.

No he doesn't, he has 'nobody' or 'httpd' or whatever the local restricted account is, not going to be listed in sudoers, etc.. But it's *still* a local account, if that's all that's required for an exploit, you have root, there's just one more step involved. 'Security is a process' and all that.

Re:Local vs. remote

[metaforest]

Good luck threading through Apache, et al. Any reasonably well lit bulb has shells for those users mapped to a non-shell exe such as 'true' or false. You'd have a heck of a time getting local access via a typical service set up.

There is no threat.

[Anonymous Coward]

There's no need.

The folks who write that shit won't write any malware for Linux. It would be like a Muslim terrorist group attacking Mecca.

Linux is safe because of ideology. This discovery of the security flaw was just an intellectual exercise.

Re:There is no threat.

[Squalish]

O Rly?

Re:The malware authors will go crazy with this

[AigariusDebian]

Bank accounts that are mostly managed by Linux servers now.

They don't claim no exploits

[Anonymous Coward]

> As far as I know, only one OS claims no exploits, and that is OpenBSD.

Actually, they claim only one remote exploit in the default install for the past however many years. Because they actually did find a remote exploit once, not to mention that there have been plenty of local exploits (though relatively few by comparison).

Re:Yeah, those windows lusers will just fuck a few

[Verdatum]

If you're gonna woosh, or meta-woosh, at least make it funnier than that!

But it was there the whole time

[Sycraft-fu]

I think that's his point. You have, in fact, been able to escalate without privilege for a long time. It wasn't known you could, but that doesn't mean the bug wasn't there. It was "obscure". The reason Linux was secure from this kind of arbitrary escalation was because people didn't know the trick to doing it, not because the security was such it couldn't be done.

I'm not saying I agree with the GP 100% or anything, but he raises an interesting point. One of the oft lauded advantages of open source is the "many eyes" thing. It is claimed that there aren't major holes since so many people can look at the code. Well, this demonstrates that isn't always the case. This is a LONG standing bug. However, despite the people looking at the code, it wasn't noticed. Only now has someone discovered it.

Re:But it was there the whole time

[DMUTPeregrine]

It's not claimed that there are no major holes, merely that major holes are less likely. OpenBSD is one of the only operating systems that focuses enough on security to eliminate the majority of such holes before release. And even then they occasionally have holes they need to patch. Without such extensive security audits one is bound to have more security holes.

Re:Yeah, those windows lusers will just fuck a few

[Anonymous Coward]

Hi Dan Lyons! Looks like you got the facts wrong again. No compiling is necessary, a live kernel patch is done using the same system update tools as for any other application.

Vulnerable by design

[0xABADC0DA]

In normal configs, Linux is vulnerable to this kind of problem by design because it runs unsafe programs and then for efficiency the kernel also has direct access to it's memory plus the memory for a process doing a syscall. And it's not just a NULL pointer, and preventing maps for page zero doesn't solve the problem... it just means you need to find a bug where you can corrupt a function pointer to point to mappable space.

What this demonstrates is that the cost of isolating programs from each other by using separate memory spaces has a much higher cost than commonly understood. It either has a ~10%-20% overhead and is insecure by design (kernel map includes calling process memory space) -or- it is far slower than even that, but safe (kernel memory is completely separate from process). Computers are already faster than many users need... maybe it's finally time for an OS with a single memory space, like JavaOS or jxos, or even Singularity.

Re:Vulnerable by design

[Tenebrarum]

and preventing maps for page zero doesn't solve the problem... it just means you need to find a bug where you can corrupt a function pointer to point to mappable space.

In before "use PaX" ...as I do?

Re:Vulnerable by design

[Anonymous Coward]

PaX does NOT protect against this type problem; the kernel can still jump into code mapped by the application.

PaX can prevent particular instances of this type of problem, like a NULL page attack, but in general it does not. You can still get code loaded at arbitrary addresses, so a kernel bug can still cause it to jump into an application's code. You just have to be slightly creative to do it.

To reiterate, this is an entire class of problems, where the kernel jumps into user process code, and the only real protection in linux is to completely separate the kernel and process memory spaces (there are kernel config options that do this), at a huge price in terms of performance.

Re:Vulnerable by design

[cstacy]

What this demonstrates is that the cost of isolating programs from each other by using separate memory spaces has a much higher cost than commonly understood. It either has a ~10%-20% overhead and is insecure by design (kernel map includes calling process memory space) -or- it is far slower than even that, but safe (kernel memory is completely separate from process). Computers are already faster than many users need... maybe it's finally time for an OS with a single memory space, like JavaOS or jxos, or even Singularity.

The Lisp Machine (ca. 1977-1999) was a single memory space, and the hardware validated that memory references were to proper objects (including functions); each physical word included several bits of type tag. This approach eliminates bugs such as casting, bad pointers, array bounds, etc. There was no privilge separation or application isolation of any kind. But it is easy to imagine adding a couple more bits to each word to implement that.

We called it the "Lisp" machine, but a better name would have been the "Object Machine", because that's the main feature of Lisp that it was implementing. (The machine had many other cool features I could go on about, but enforcing the object model and type checking in the hardware was really the biggest thing. This went along with the hardware assist for garbage collection, btw.)

Re:Vulnerable by design

[True Grit]

In normal configs, Linux is vulnerable

The problem you're describing is not an issue just for Linux but most current 'conventional' OSes. On any OS with a shared memory space as you described, if you can a) 'hack' a pointer, and b) move or map your own code to where that 'hacked' pointer is now pointing to, and c) combine this with some other exploit/bug to get elevated privileges in the code you inserted earlier and take immediate advantage of this, then you can theoretically pwn the system whatever its OS (as always, it depends on the specific circumstances).

As you say, this is fundamentally a weakness of the hardware-assisted approach to process isolation, because in a paradigm that allows modifiable pointers in userland code, neither the hardware nor the OS can ever *really* know what the pointers are actually pointing to.

It either has a ~10%-20% overhead and is insecure by design (kernel map includes calling process memory space)

Not sure I'd go as far as 'by design', at the very least its not an easy exploit to accomplish (not withstanding this latest problem), since it depends on finding at least one bug/flaw in the OS to let you do the first step of 'hacking' a pointer (and usually at least one more bug/flaw to be able to do something really dastardly), but yes, there is an overhead, and its certainly not a perfect model (what is?).

maybe it's finally time for an OS with a single memory space, like JavaOS or jxos, or even Singularity.

If they can get it right, absolutely.

In fairness however, these OSes accomplish their goal by restricting you to a type-safe language(s), in effect, they (try to) avoid the problem of pointers being 'hacked' by eliminating the presence of writable/modifiable pointers that *can* be 'hacked' within running code. They use the strictness of the language as the protection mechanism, rather than hardware assistance. This however is not trivially easy to accomplish either (see jxos and their 'Isolates' mechanism they're having to shim into their system), which is why these OSes remain work-in-progress research projects. Then, once they do get it right, we won't be able to just 'port' all our current software over and take off, nope, all the software we use now will have to be rewritten in a type-safe language that that OS supports (or thrown out!), so the switching over process won't happen anytime soon. :(

It is a 'cool' idea though, if for no other reason than it avoids the overhead of the hardware assisted model, and eliminating modifiable pointers (at the source code level) in code will allow smarter static/jit compilers to safely do *far* more aggressive optimizations than they can do now, as modifiable pointers (especially if they can also be aliased) are the single biggest headache for any optimizing compiler.

Re:Vulnerable by design

[nwmcsween]

Correct me if I'm wrong but a single address operating system with a JIT VM within the kernel could be *faster* due to static compilation before into some sort of bytecode / machine code and than the VM can simply optimize depending on how the program is executing, something like HP's Dynamo http://www.hpl.hp.com/techreports/1999/HPL-1999-78.html

Re:Vulnerable by design

[rastilin]

In normal configs, Linux is vulnerable to this kind of problem by design because it runs unsafe programs and then for efficiency the kernel also has direct access to it's memory plus the memory for a process doing a syscall. And it's not just a NULL pointer, and preventing maps for page zero doesn't solve the problem... it just means you need to find a bug where you can corrupt a function pointer to point to mappable space.

What this demonstrates is that the cost of isolating programs from each other by using separate memory spaces has a much higher cost than commonly understood. It either has a ~10%-20% overhead and is insecure by design (kernel map includes calling process memory space) -or- it is far slower than even that, but safe (kernel memory is completely separate from process). Computers are already faster than many users need... maybe it's finally time for an OS with a single memory space, like JavaOS or jxos, or even Singularity.

That would be livable if there was also a "unsecured" mode we could use. Sometimes the machine doesn't have any worthwhile data on it and you just want maximum FPS for gaming or whatever. The early Windows was still very popular despite it's comparatively worse memory model.

Arch kernel

[mtemmerm]

mmap_min_addr already set to 4096 there... Plus I don't really see what all the fuss is about: how does this make an affected desktop OS any more vulnerable?

Re:Arch kernel

[Mia'cova]

It automatically makes many other otherwise minor bugs, eg a browser bug, suddenly a root exploit.

Uptime

[4pins]

The next time someone quotes me an absurd uptime number I am going to compare it against this date.

Re:Uptime

[cenc]

Depends what you do with your box.

For instance my local office server that is not really connected to the internet, and has no local users besides myself that can access it directly. So, to use this exploit on it would involve one extra step. A step over my dead body. Thus, not in a panic to go patch this anytime soon.

I am really more concerned about the up time of my beer cooler.

Re:It's from April? Really?

[Caesar Tjalbo]

Maybe the world simply forgot to check for Y2K++ bugs.

Re:It's from April? Really?

[Anonymous Coward]

Posting anonymously for a reason... I knew about it 3-4 years ago. I discovered it disassembling some hack/crack code and verified it against the kernel sources. I used it myself quite a bit before changing careers. I know slashdot doesn't want to hear it, but having access to the source code helps find and verify root exploits.

Requires zero page to be mappable

[Tweenk]

This is not exploitable if the zero page is not mappable. Which means, most of the time. If you have a mappable zero page then you will get owned sooner or later, because it makes the whole concept of NULL as used in C invalid.

Re:Requires zero page to be mappable

[metaforest]

The soundport driver had a similar issue, and it was discussed at that time that with the right offset you wouldn't need to map page zero to exploit the issue because:
{
somestruct* foo; ...

  foo[some_useful_offset].endelement = something_dangerous;
}
This code will NOT dereference addr = 0x000000 at any time
  in fact it doesn't even have to reference page zero!

Re:It's from April? Really?

[alexborges]

Fixed bug in two days. Thats all I have to say.

Windows has, TODAY, KNOWN, available in the WILD, remote root exploits unpatched for 8 years now.

Ubuntu Hardy 8.04 server has it at 0

[wytcld]

True, but Ubuntu 8.04 x64 Hardy Server LTS has that set to 0! This is on thoroughly-updated systems too (and a lot of servers will be running the LTS release, not 9.04).

Re:Ubuntu Hardy 8.04 server has it at 0

[wytcld]

Ack! Was forgetting what I had loaded where. One version of 9.04 x64 had it at 0. Two Hardy servers did have it at 65536. Two x32 9.04 boxes also had it at 65536. Of these, only the one with it set at 0 started with an Ubuntu earlier than Hardy. So presumably it depends not on what you're running, but what you first installed.

Check older boxes independent of current OS version!

Most Importantly

[Anonymous Coward]

Is my pr0n safe? Dude, no way do I want it compromised.

The Rhythm method

[Deliveranc3]

Ok this one is nasty, provides total access. Can we get the results of the search for the code to exploit this?

Is there a department that searches down people who exploited a vulnerability once we figure out how they did it? It seems sensible to develop such a feedback system, probably won't get the serious hackers but for the hackers who mess up there's probably a trail.

Worst method of detecting virii:Feel your computer timing is different? Could be a virus. Of course they're taking this from us with SSD but meh... whatever floats the boat.

Re:It's from April? Really?

[alexborges]

// leeches.c:Aug 11 2009

August, not april. Where the fuck did you get april from?

secunia.org

There is your linky...

Hell, at least you get PAID for being a MS fanboi.

Re:It's from April? Really?

[__aagmrb7289]

See, calling me a MS fanboi has no basis. Just like your arguments. This is why you are a fanboy (notice how close fanboy is to fanatic? And how fanatic sounds like zealot? Have you ever looked up the meaning of those words?). As for the April thing - read the thread. It's right there. It might be WRONG, but it's there. No really - READ SOMETHING. Try it. Might hurt your head a little, but being a fanboy isn't really good for your health anyway. As for your link - nice try. If you actually WENT to the link, and USED the database, you'd see that your assertion isn't correct. Want to try again, little fanboy?

Re:It's from April? Really?

[__aagmrb7289]

Oh hey, watch this! I'm sure this'll blow your mind - I'm sure it's never happened for you before. I'm going to admit something - I was wrong! It wasn't April - I misread the comment. It WAS report August 11th, 2009. Sorry, that part I was wrong about.

If you'd care to continue "discussing" the rest, feel free to respond. I'm sure the fact that it was "reported" only two days ago means you can completely ignore that it's been there since 2001. And you can ignore the fact that your assertion about Windows having bugs around that long that are reported and unpatched is completely unfounded.

Re:It's from April? Really?

[alexborges]

No need to say anything else, "foe" (i think you're the only person that uses the friend-foe system at /.).

No company, person or group can be accused of fixing what they dont know about. If there hasn't been any kind of in-the-wild exploit for this, and for know it hasnt (there will SURE be some very soon, but thats only because of this particular disclosure and can be thwarted by updating), then its safe to say that all that COULD be done, was done for fixing this bug and in no particular way does it make the Linux kernel less secure than any of its competitors.

On the other hand, the timely fashion in which it was patched leads me to conclude that the FOSS model is much more secure as it gets patches faster out the door once an exploit has been discovered.

Now... do YOU care to discuss intelligently?

Re:It's from April? Really?

[__aagmrb7289]

Of course I want to discuss this intelligently. I don't expect that from you, of course - which is why I've made sure to mod your comments to oblivion (that system works - it removes a lot of the FUD). I don't think the Linux kernel is less secure than its competitors. I'd even suggest it is likely MORE secure. However, your original comments were idiotic, and very fanboy. This isn't what you said at first. You called Windows users idiots, and praised Linux because it is just so awesome - ignoring the fact that this was a pretty shitty bug - and that it's been there for a long time. As for it not being exploited - well - that we know of. Hard to say anything solid about that, is there? I AM impressed it was patched so fast, and I will be patching my myriads of Linux servers at first opportunity. I am a little impressed that you've managed to mostly shutter the fanboy crap you've been spouting in this post, but my impression hasn't yet changed. Did you want to back up any of the other assertions you've made that I challenged you on? Or are you ready to let those go? I'd honestly love to have my impression of you be wrong - that this was just a shitty day for you or something. So please - do prove me wrong again.

Re:I can hear the OpenBSD users laughing already..

[AceofSpades19]

Wait....theres another one?

Re:It's from April? Really?

[alexborges]

Ah...

How the hell can you mod if youre posting? Do you keep an extra account with modpoints somewhere or get help from friends? Wow, pretty sophisticated.

Or do we have a bitch ass whiner account now @ /. to report "offensive" posts? It would be a crappy day for me if this was the case.

And no. You like to tag me as a fanboi because of what I said. Here:
Oh...

So it was disclosed the 11th of august and linus has a patch today, HUH? GOOD THING: QUICK PATCH

There are YEAR OLD bugs with this exact level of danger that microsoft simply has not patched and still refuses to patch. ABSOLUTE TRUTH TO ANYONE IN THE SECURITY INDUSTRY

Fuck you, I love my os BECAUSE i know beforehand that it will be fixed in no time.... For this case, even you say im right

Windows people are just plain stupid, really. I dont think YOU are a windows user, I pitty you if you are forced to be one.
 

Re:It's from April? Really?

[Anonymous Coward]

Well since I am a Windows (and Linux) user, your GP post called me stupid. I'd like to respond in kind, but I don't believe it is nice to call folks with mental aberrations names. So you get a pass there. However, REMOTE EXPLOIT vulnerabilities in Windows unpatched 8 years? Link to something other than some random nut's blog or it doesn't exist. Where's the CVN number or the Secunia bulletin or the like? Oh, right - this doesn't actually exist and you were smoking crack again...

Oh, and you do know that a real remote exploit is not an enticement attack, right?

Re:I can hear the OpenBSD users laughing already..

[couchslug]

"Sure there are. And they are both laughing."

Such a brave front. Their OS is dying, yet they show no fear.

Re:It's from April? Really?

[Anonymous Coward]

I would guess it's been used by pr0n and social networking sites, exploiting moz/opera/whatever, against whoever visits, feeding gathered personal information to centralized databases that are distributed to government and employers. Your ability to climb the social ladder is then less related to your performance and more related to whether or not you browse the same material as your corporate superiors. You know those days when it seems that some of the people in the hallways know when you've been looking at pr0n? Guess what. They do.

It would not be that difficult. Most browsers tell the remote server what browser they are. How difficult would it be to load the server with pages which contain exploit code which can be swapped in accordingly? There's a project on the web that's devoted to creating building block copy and paste exploits to insert trojans... I forget what its name is.

If Windows is your metric

[synthesizerpatel]

Linux is ready for the desktop!

Oops. Long day

[michaelwigle]

You're both right. I got physical access and local account mixed up in my brain. My excuse is long day. Oops.

Big 5-Oh

[Anonymous Coward]

Oh well. Time for a reinstall anyway. Can't complain 'bout 4+ years uptime.

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

Hahahahahahahaha ...
Hey!

Re:local... remote... -- WRONG

[zukinux]

It would be quite an accomplishment to introduce a remote exploit directly in the kernel.

Here you go : that's not that hard to achieve (well, it is, but that's not impossible) : http://dvlabs.tippingpoint.com/advisory/TPTI-06-02 (Driver BO will run on kernel-mode obviously), so remote BO's on kernel side are not that never heard of.

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

OpenBSD has less users, because only people that care about security use it.
A normal user sees that his 3D games run slower and goes back to Lindows. People that care about security, however, learn that it is slow because does more to protect you.
Linux and Windows devs just set CC -O3 and release. Maybe the compiler optimized out their memory protection, or encryption, or replaced the RNG by a PRNG that always returns 1337.

Re:It's from April? Really?

[Anonymous Coward]

I would love to know if this has ever been used as an attack before this announcement and by who to whom.

Although I haven't yet looked at the patch for this hole or the discussion about it...

Historically - certainly throughout the entire 1990s - it was necessary to read Bugtraq regularly to learn about new holes and commonly patch them yourself. At first a patch for the hole would be debated in security circles rather than mailing lists associated with the application.

More importantly, however, is the consistent pattern that holes were discovered by hackers and kept private. Obviously it would get shared slowly - each new person having the ability to go public and claim they discovered it.

Independent discovery was very common, of course. I'm sure you had independent discovery of certain holes by government agencies, multiple hacker groups (or at least informal sets of friends that shared things within that clique), and security businesses. (although the security businesses learned about a lot of holes by employing hackers. Consider that a lot of the major security businesses today probably were started in an age when there would be a motivation to also keep a repository of unknown security holes, to be released on a schedule deemed most beneficial for PR reasons. Considering the huge motive, it makes one grateful that we can trust that it never happened due to the integrity of those involved.)

Being awarded financial benefit (credibility as a discoverer of security holes was beneficial to companies selling security products and individuals wanting to be hired by those companies) changed the landscape, and shortened the time between discovery and public knowledge.

Except for the government, of course, who does not have the same kind of profit motive.

And yet the government does on occasion make a security hole public..

Re:pwned True Genius vs Pirate King

[xaboo]

I am still waiting for Bill Gates to patch my windows 3.11 vulnerability. What do you think? Will he patch it himself?

Re:It's from April? Really?

[Anonymous Coward]

>which is why I've made sure to mod your comments to oblivion

Brilliant. You've made me read every one of his posts since I had to see what you were replying to.

this bug was caused by gcc

[treat]

The reason this bug was not detected sooner is that there was a check for a null pointer, which GCC optimized out! No one is checking for these kind of bugs - ones where analysis of the source code does not match what was compiled.

Time to re-read Reflections on Trusting Trust http://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf

And here's the quote that it wouldn't have happened if not for gcc:

http://lwn.net/Articles/342420/
Yet another link in the chain of failure is the removal of the null-pointer check by the compiler. This check would have stopped the attack, but GCC optimized it out on the theory that the pointer could not (by virtue of already having been dereferenced) be NULL. GCC (naturally) has a flag which disables that particular optimization; so, from now on, kernels will, by default, be compiled with the -fno-delete-null-pointer-checks flag. Given that NULL might truly be a valid pointer value in the kernel, it probably makes sense to disable this particular optimization indefinitely.

What's the remedy then, Cmdr?

[Anonymous Coward]

Why is it that all the nerds dream about Power6 architecture processors and the return of the Alpha 21364 Valkyries to usher their /var into the Great Halls of Justice?

And you want to settle for a snotty-nosed twat that has downtime every month for a week at a time and can't even return the answer to simple arithmetic?

Get off my /. astroturf!

So can we download source and recompile?

[JSBiff]

Is fixing this problem as simple as recompiling the kernel with a tweaked makefile or something, to tell GCC not to optimize that type of code out?

Eyes Wide Shut

[westlake]

Because while under many eyes, all bugs are shallow, that only works if the eyes are actually looking.

For eight long years no one was looking. Tell me again how the geek spins this story in a way that inspires confidence in Linux and FOSS?

Re:Eyes Wide Shut

[calmofthestorm]

Because we fix it instead of hushing it up until it becomes fairly well known and then waiting a month to fix it.

Re:Eyes Wide Shut

[Anonymous Coward]

Because we fix it when someone finally notices it after eight years and then hush up so no one will know we didn't notice it for eight years and then when someone notices that we didn't notice it for eight years and makes everyone aware of that we then try to minimize the impact by saying "We fix it instead of hushing it up until it becomes fairly well known and then waiting a month to fix it" instead of hushing it up until it becomes fairly well known and then waiting a month to fix it.

FTFY

Re:Eyes Wide Shut

[u38cg]

Well, this sort of thing is what happens when you program in C. Obscure bugs happen, particularly in a large piece of code like a kernel; after all, no-one can trace every execution path. The difference? I now know what happened, what caused it, and that it's fixed. On Windows? "Updates are ready for your computer". Is that really a better feeling? If so, psychology is beating logic.

Re:Eyes Wide Shut

[jonaskoelker]

Tell me again how the geek spins this story in a way that inspires confidence in Linux and FOSS?

Because proprietary kernels have at least as much code that hasn't been looked at for at least as long with more exploits.

And you can't prove me wrong, because no one has published those numbers!

(err... wait... *wipes foam off mouth*... My life for Aiur...)

Re:Eyes Wide Shut

[Anonymous Coward]

And you can't prove me wrong, because no one has published those numbers!

You made the claim, the onus is on you to provide those numbers.

If you're particularly worried. . .

[JSBiff]

That's a good point.

To really be 'safe', you'd probably want to boot from a known good CD/DVD, install the fixed kernel from the CD/DVD, then reboot from the new kernel on the hard drive, yes? I mean, if your kernel is owned, the rootkit might protect itself somehow from you trying to install a fixed kernel.

Obligatory Star Wars Reference

[StormReaver]

It was as if a million mirror sites cried out, and were suddenly silenced under the upgrade onslaught.

NULL is a very useful pointer.

[qieurowfhbvdklsj]

Why the bloody hell isn't page 0 hard-wired to panic the kernel / SIGSEGV the userland when accessed?

Well, for one, DOSBOX wouldn't work so well anymore. When you set up for vm86 mode, you allocate things into your own memory space at the addresses you wish them to be at in vm86 mode. It would also affect any attempt to use VESA video drivers since the pointer to the handler of interrupt 0x10 is in page zero.

The sensible thing would be to redefine NULL to be a completely useless pointer (like, -1, for example) rather than choosing what has to be the single most useful number in all of computing. The first address is rather useful since anything might be there, whereas the last address isn't quite so useful since nothing more than a single byte could possibly be there anyway. ...but, if you think we have problems now, just imagine the confusion caused by a NULL that isn't zero.

Wait! I have a better idea. Let's just give up C. I think we can all agree that pratically every bug ever has been caused by the fact that it forces programmers to constantly re-invent the wheel, creating their own string and memory management to make up for the fact that what is supplied in the language is barely functional at all. Programs written in langauges with proper string and memory management don't have to worry about null pointers and buffer overflows.

Perl scripts aren't bothered by buffer overflows, whereas the average C program apparently can't so much as accept a password without a buffer overflow. If they could at least do that much they'd limit damage to people with access privleges, but every year or so some important piece of software like SSH has some vulnerability which doesn't even require a proper login. Apparently it's impossible to keep the bugs out of even that small portion of the code that deals with rejecting people without proper credentials, nevermind the rest of the code that does everything else.

Obviously what the world needs is an easier programming language because C is just too fucking difficult.

Re:NULL is a very useful pointer.

[pizza_milkshake]

http://bugs.gentoo.org/show_bug.cgi?id=198196

assholes

[tapanitarvainen]

have you ever thought what life would be like if you had no asshole? Things would get quite miserable, very quickly.

There are animals without an asshole, like anemones, and they don't seem to be particularly miserable. They have just one opening into their body cavity, which handles the functions of both mouth and asshole.

Hmm. Given what comes out of some politicians mouths, maybe they don't have assholes either...

Re:assholes

[Runaway1956]

One reason that I've never aspired to be an anemone, OR a politician.....

This is a flaw in x86

[pclminion]

This actually is a flaw in x86. Under the x86 segmentation model, it is impossible to transfer control from ring0 code to lower-privileged code. This is precisely to prevent this type of attack, where you can trick the kernel into calling a function inside user-controlled memory. (You can, of course, transfer control from ring0 to a less privileged ring, but it's far more deliberate process).

However, Linux doesn't really use the segmentation system all that much. Instead it relies on the paging model to enforce the user/supervisor distinction. Problem is, the x86 does NOT prevent code running from a supervisor page from transferring control to a user page. Intel's excuse for this is that "you can use segmentation to achieve that protection" but as we all know, nobody uses segmentation for shit.

Let me say this all over again. The bug is not in the kernel -- it was performing a NULL check which gcc was optimizing away. It is not a bug in gcc, because according to the ANSI C standard, NULL cannot be dereferenced, and therefore a dereference followed by a NULL-check is redundant and can be optimized. It is a bug in the kernel build system (for not setting the proper flags to tell gcc that's it's not compiling ANSI C code, it's compiling kernel code) and it is also a bug in the CPU itself (for allowing direct transfer of control from supervisor pages to user pages)

Re:This is a flaw in x86

[fnj]

On the whole I follow you every step of the way and agree with you. Except on one point. In my opinion, C compilers like gcc that behave this way are broken . Just because ANSI C says null pointers cannot be dereferenced should not bloody mean that they should merrily remove logic that you have added. With its roots as a convenient standarized assembly language surrogate, C is the last language that should even think about doing stupid things like this. ANSI C says that the results of certain operations are undefined. That does not mean the fucking C compiler should merrily take advantage of every loophole to wreak havoc, gleefully cackling while it does it. What is my rationale? Simple. My rationale is stupid and needless bugs like this one. There is nothing in ANSI C that mandates reckless compile behavior. At most, the standard only allows it but does not require it. Nobody has to do things they know are wrong just because the law allows it.

The overhead of a null check is ridiculously insignificant.

I guess I'm old fashioned. If there is a line in the source code, it is there for a reason. The compiler should fucking do what the source says to do , or issue a diagnostic as to why it can't.

The places where I have shouted are not at you. They are at whoever as a group has conventionalized these imbecilic design decisions in the compiler community. Sorry about the veins standing out on my forehead.

Re:This is a flaw in x86

[clone53421]

Even if GCC doesn't optimize away the NULL check, couldn't you write the same code in assembly language without the NULL check and exploit the bug? GCC is only one way of creating a binary; if a binary created by GCC can exploit the system, fixing GCC won't prevent you from creating the same binary via other means.

Re:I can hear the OpenBSD users laughing already..

[BlueParrot]

The difference is that while the windows fanboys are serious about it, the similar comments about BSD in this thread were quite clearly jokes. Seriously nobody denies that this is a serious bug, nor do I think you will find many people ( even Linux developers ) who deny that OpenBSD is one of the most secure general purpose operating systems there is. You do however have some people who have clarified exactly what problems this bug does and does not cause. In case you didn't catch it already I'll summarise:

-This bug on its own does not cause a remote exploit

-However, If you are running a service, and that service has an exploit in it, then this bug could allow an attacker remote root access.

-This bug could allow programs that are run without root privileges to obtain them, and this is a serious issue on multi-user set-ups.

-If you really must compare it to windows then Windows XP in its default configuration allows programs to do this BY DESIGN

So basically. Yes it is a very serious bug. Yes the fact that XP is retarded enough to allow this thing by default is not a reason for Linux users to be complacent. No this does not mean that Linux is not a lot more secure than windows.

Re:I can hear the OpenBSD users laughing already..

[tres]

Don't get me wrong, I'm not taking up a flag in the holy war; I'm a happy and grateful user of both BSD and Linux. I'm just making an observation about something that bears a lot of resemblance to the response made by the poor lot stuck with Windows. It seemed an interesting irony.

No "Haha" tag?

[joetheappleguy]

Seriously? Windows and Mac vulns get the tag, why not Linux?

Linux exploits are no laughing matter, maybe?

BSD

[Hucko]

Looks like I wasn't fast enough learning BSD or Solaris :(

Sigh.

Is anyone working on a Plan 9 64bit clone?

Re:It's from April? Really?

[Anonymous Coward]

Slashdot doesn't want to hear it but your detailed explanation is so convincing that we have no choice.

Your new math is very flawed.

[WebCowboy]

It's also worth noting that kernel 2.6 alone contains 186 advisories for 352 vulnerabilities with 6% unpatched. Windows Server 2008 contains 40 advisories for 82 vulnerabilities with 0% unpatched.

Your comparison is very flawed and meaningless. Linux kernel 2.6.0test was released in 2003--IT HAS BEEN AROUND 5 YEARS LONGER THAN SERVER 2008! If you want your math to actually make a real point try integrating the vulnerability rate of each OS over the same time domain. Simply put, you have to look at the combined vulnerabilities reported by Windwos Server 2003 AND 2008 when comparing against Linux 2.6.x kernel based OSes.

More proper numbers for Windows would be 242 advisories for 341 vulnerabilites. Slightly lower vulnerability count but quite a few more advisories. 6% of these vulnerabilities also remain unresolved. These numbers do not show Microsoft having any meaningful advantage in quality over the Linux kernel

And, to be more fair still, you should compare OS to OS as you said, rather than OS to kernal. For RHEL5 OS the stats are 272 advisories for 828 vulnerabilities and zero unresolved (suggests that one advisory and pne patch probably solves many separately counted vulnerabilities--perhaps because Linux-based OSes leverage shared libraries far more than Windows?) Keep in mind, however, that Comparing SLES or RHEL strictly speaking wouldn't be a complete comparison either, because in Linux OS distributions many applications are included where the equivalent in Windows would be separate (possibly extra-cost) add-ons.

Furthermore only counts are considered above, with no factor for intensity. Windows server 2008 has more than double the rate of "highly critical" vulnerabilities (35%) than does RHEL5 (16%) and it is well known that Linux exploits are far less likely to be directly remotely exploitable than is the case for Windows exploits.

Yes, MSFT has made great strides in closing the quality and security gaps in ther server OSes (quality is still sorely lacking in their desktop offerings), but even if Windows was perfect I'd still prefer a Linux OS or OpenBSD:

* can't afford Ballmer'$ ga$
* Windows is closed--I don't trust what nobody but the vendoar/author can see. Secunia et al can only report what they can observe from behaviour. As in this reported Linux exploit, third-parties can perform extremely detailed analysis with source code at hand, often releasing the patch to plug the exploit right along with the exploit itself.
* licensing and actrivation take a lot of time and resources that serve no practical purpose than to enforce an increasingly questionable business model--Activation is pure bulls**t. I've wasted FAR too much time on clients issues where the root cause of functional deficiencies was improperly activated/licensed closed software (be it Windows or others). I've HAD it with closed crippleware.
* I like to tinker. I like to build. The playing field is for more flat in Free software land than in Windows land. I can reconfigure kernel modules, choose which web server, DNS server, email server I want to use and evaluate them truly on their merits. In Windows, if you think IIS or Exchange or MS DNS Stinks, you can try the alternatives but they always seem hobbled by comparison. MSFT never lets third parties play by the same rules, especially when server apps are considered "windows componenets" like with IIS and DNS. They get to leap MSFT's long-professed "chinese wall" to get total access to OS internals info others do not have. ANYONE who wants to write server apps on a Free platform has the same access to info.

Re:Your new math is very flawed.

[amicusNYCL]

Your comparison is very flawed and meaningless.

Clearly, and you could have stopped there. I wasn't trying to make a major point and get a +5 comment, he told me to look it up on Secunia and so I did. There are about 25 versions of Windows listed there, and I didn't even include XP or any consumer OS, so obviously it doesn't mean a lot.

That's not even considering the fact that one bug that lasted over several versions ends up counting as more than one.

Re:Your new math is very flawed.

[joggle]

While there are certainly strong arguments for open-source software, it is not a fit-all solution.

For example, one of my big hobbies is doing 3d modeling and animation. Even though I'm not doing it for-profit, I use a closed, proprietary program (3ds Max). The simple reason is because I feel it is the best product for the job within my ability to afford and I can use it much more efficiently (and get a better result) than I could with any free or cheap alternative. Sure, there is an open-source alternative (Bender) but it simply does not stand up against 3ds Max. Without the deep pockets of a corporation with customers paying big $$ for the product it is virtually impossible to create such a complicated program using only volunteers, especially when the program needs to change substantially year to year just to keep up with the latest research and demands.

Another similar example, document creation, does work with open-source. I think this is true because many people do not demand much of their document software and that software can be relatively stable year to year and still be a useful product.

The other case of being able to create complex open source software that does need to change substantially year to year are sponsored by corporations and have very large appeal (like Qt and the Linux kernel). However, it's hard to imagine a major corporation spending much money on a complicated niche product like a 3d modeling/animation tool.

Countering Trusting Trust!

[Anonymous Coward]

Ken Thompson's "Reflections on Trusting Trust" is a recurrent Slashdot link but people never link to the counter argument article David A. Wheeler's "Countering Trusting Trust. It doesn't give a complete view to leave out the second article...

Re:It's from April? Really?

[Yfrwlf]

Of course this is probably BS but I'll bite any way...you didn't tell anyone so you could use it against others? How nice of you. Luckily the code is open, so unlike with closed code like with Windows, secrets won't last as long. ^^

(not to mention with the help of the power of the typical GNU/Linux OS with all the monitoring and power tools that are available to find out about such exploits)

Re:It's from April? Really?

[someone1234]

Yeah, 8 years are nothing in the world of Linux...
The only difference between Linux bugs and M$ bugs is that when they become known, an informed user could fix his system in hours.

Though i agree, the GP is most likely bullshitting.
And i'm still in shock how could something like this stay invisible for such a long time.

Re:It's from April? Really?

[Engeekneer]

Well, it seems to be an obscure macro error, which only revealed itself to be a bug when digging deeper. So, since there isn't a dedicated team reading through ALL the code lines carefully thinking about the implications in the code, these things just happen. I bet there are even older bugs in the kernel code that just haven't been found.

And... He is also a politician!

[Anonymous Coward]

nobody (the apache account) is a local user.

That nobody guy is really smart.

I often tell people that nobody is smarter than me.

Vote for Nobody!

• Nobody will keep election promises!
• Nobody will listen to your concerns!
• Nobody will help the poor and unemployed!
• Nobody cares!
• If Nobody is elected, things will be better for everyone!

Nobody tells the truth!

(http://thecynicaleconomist.com/wp-content/uploads/2009/07/vote_nobody.jpg)

Re:I can hear the OpenBSD users laughing already..

[xtracto]

Howdy fuck, that guy is completely gross. I didn't know Stallman was that dirty. That is the most disgusting thing I have seen in a while.

Possible workaround

[vviljo]

It would seem a possible workaround is to disable all vulnerable socket protocols via modprobe.conf (or equivalent) so that user space cannot open e.g. ppp socket at all.

Mostly these vulnerable protocols are not needed in a typical server.

Re:It's from April? Really?

[Yfrwlf]

No, eight years isn't nothing, and yes any software can have bugs and holes, but like we said open source means more fixable. If it was being exploited though, it probably would have become quickly patched, so most likely only a small few knew about it, if anyone. I'd much rather have the world community see and fix code than have one small company in comparison hide their code from everyone else.

Re:It's from April? Really?

[__aagmrb7289]

I'm not modding anything. Hello? Where is that coming from? I honestly have no idea what you are freaking out about. All I've done is:

1. Tease you for being a fanboy
2. Respond and challenge you on your assertions
3. Mark you, personally, as a "foe" so I don't have to read your craptastic fanboy b.s. that I saw, time and time again, after reading through a sampling of your "comments" from various topics

And yes, I'm tagging you as a fanboy because of what you said and how you said it - and that is from just about every reply you've made in this thread. I'm sorry that you can't prove my disdain from you misplaced. You have yet to even bother admitting to the many mistaken assertions you have made in this very thread, that I took the time to point out. Have a great day - don't expect to hear from me again (I won't even know you are there!).

Re:It's from April? Really?

[alexborges]

In this you are right. It was an exageration. My first post is much more on the nose: there are unpatched local privilege escalation bugs in windows unpatched and known for years now.

Proof of concept

[jspenguin1]

Available here. Does not try to get around mmap_min_addr. Use at your own risk.

Why would this work?

[argent]

Why on earth would the kernel have the execute bit set on its mapping of pages in userspace? What is the purpose for having the capability of executing code in userspace from the kernel?

Re:Why would this work?

[jspenguin1]

Because userspace has to execute it. In order to mark userspace code non-executable, the kernel would have to do a task switch on every system call, which flushes the TLB and degrades performance. This is how most microkernels do it -- most of the drivers are actually in userspace and they pass messages back and forth between application and driver. A hardware solution would be to have a way of marking pages "user space executable only", sort of like NX, but still allowing user code to execute. This probably won't happen, though. The best defense is to check the durn pointers in the kernel.

Re:Why would this work?

[argent]

In order to mark userspace code non-executable, the kernel would have to do a task switch on every system call, which flushes the TLB and degrades performance.

And here I was assuming the kernel did that anyway. I guess things have changed a bit since the PDP-11.

Numerology

[dbIII]

The numbers mean nothing if there is no indication of what they are measuring. You can really only consider how severe each individual vulnerability and think of things that way unless you want to win a meaningless argument comparing the number of apples to aardvarks. That's the situation we're getting from a marketing point of view where this numerology is used as a distraction in an attempt to show the only platform compatible with malware doesn't have a problem with malware. Meanwhile things are steadily getting fixed on both platforms by people that would find the argument annoying and pointless.

Typical FUD from an M$ employee

[Anonymous Coward]

M$ employees have been trolling Slashdot by astroturfing and posting FUD. One notable M$ employee has Numerous accounts on slashdot for the sole purpose of astroturfing for M$ and spreading FUD. I have wondered about you for some time and now your latest post all but confirms you account is merely a troll account for M$.

--
Friends don't help friends install M$ junk.
Friends do assist M$ addicted friends in committing suicide.

More than one way to skin a cat...

[PrntlUnit27]

Let's get this out of the way first. To all of you cat lovers, I'm sorry for being an insensitive clod.

If I have local access to a computer, in many cases I can just use a Live Linux CD to gain access to just about anything I'd want on the box. For more badness later, couldn't I also then move or rename the right security files, reboot and insert an exploit, reboot with the CD again to restore the security files, reboot again without the CD, and be on my way without leaving a trail? I've never tried such a thing (really), but wouldn't someone with enough motivation and talent be able to do that to almost any computer?

Fedora also safe (I think)

[Anonymous Coward]

My Fedora install also has mmpa_min_addr set to 65536. I wonder how many other distros do this?

Re:I can hear the OpenBSD users laughing already..

[Anonymous Coward]

What, not standing there with a superior sneer on their faces, taking a short break from driving off potential users by being assholes?

Of course this explains why there seem to be more than 2 OpenBSD users--they are such assholes they seem legion.

No es tan asÃ....

[Anonymous Coward]

Pues les aclaro que el fallo sÃlo ocurre en redes que utilizan en el obsoleto protocolo Appletalk de Apple, no en el TCP/IP que generalmente utilizamos.

El mismo Linus dice en su commit (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98)

âoeDoes anybody really care about sendpage on something like Appletalk? Not likely.â

Saludos,
adrruiz

Re:Linux users are fucking bastards

[Anonymous Coward]

Windows users are also fat virgins who brown nose up their PHB's hemmoroid infested ass all day espousing bullshit about ROI that they don't really understand. And windows users tend to have neat hair.

Point is you are too stupid to exist

[Anonymous Coward]

Point is you are too stupid to exist you goof.