Slashdot Mirror
Bug In Most Linuxes Can Give Untrusted Users Root
Red Midnight and other readers brought to our attention a bug in most deployed versions of Linux that could result in untrusted users getting root access. The bug was found by Brad Spengler last month. "The null pointer dereference flaw was only fixed in the upcoming 2.6.32 release candidate of the Linux kernel, making virtually all production versions in use at the moment vulnerable. While attacks can be prevented by implementing a common feature known as mmap_min_addr, the RHEL distribution... doesn't properly implement that protection... The... bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature. ... [Spengler] said many other Linux users are also vulnerable because they run older versions or are forced to turn off [mmap_min_addr] to run certain types of applications." The register reprints a dialog from the OpenBSD-misc mailing list in which Theo De Raadt says, "For the record, this particular problem was resolved in OpenBSD a while back, in 2008. We are not super proud of the solution, but it is what seems best faced with a stupid Intel architectural choice. However, it seems that everyone else is slowly coming around to the same solution."
But you don't know if I didn't just hack the servers ;)
Surely this is the same story, from 2 months ago.
fixed that for u.
Everyone knows that....don't they?
I say "I'd rather pay nothing for bugs like this than $400 for all the same borkedness in Server 2008"
So, anti-Windows people? Whatcha say now? ;-)
Thank god that independent forces are out there finding and reporting kernel bugs in Linux. If only the bug-finders for windows were so altruistic.
...they should've listened to Linus and ignored this until now, like all the others. Linus knows best.
The bug was found by Brad Spengler last month.
I thought we discussed this in July? Or is this a different exploit?
I think it's pretty clear that De Raadt and others have been discussing this vulnerability for quite sometime. On a list of affected systems, you can see it's been known on that site since August. Here's another fix discussed that involves setting PER_CLEAR_ON_SETID mask to MMAP_PAGE_ZERO and that's from July (unfortunately, as the Register article said, that might cause problems with applications). In fact I think Spengler has been talking about this for quite sometime as I believe you can find exploit code here and a video of it in use here against SELinux. If that's not the same exploit it sure seems to be very similar in nature.
My work here is dung.
For those who just want to know how to fix it, you need to apply this git commit to your kernel tree and then either recompile and reboot or apply the patch using ksplice.
If the result is non-zero the vulnerability doesn't exist.
'Most deployed versions of linux'?.
So far only some unpatched RHEL versions allow this local exploit, even the Centos rip-off doesn't have it.
Surely this is the same story, from 2 months ago.
One word: "Kdawson"
Read again.
It says that it was only fixed " in the upcoming 2.6.32 release candidate of the Linux kernel" - hence everything before that is vulnerable.
But the bug is not exploitable on ubuntu, because they set vm.mmap_min_addr > 0 by default.
Hah, this just shows how EFFICIENT Linux is. Until recently, Windows achieved their local privilege escalation vulnerability rollout by having almost every home user running as fully privileged administrator accounts all the time. Linux achieves all this through a small tweak to the kernel build system, thus getting this feature to 100% of Linux users without any manual intervention at all.
Linux is teh roxerz!!!!onehundredeleven!!!
M$ wants to p0wn3d joo.
The null pointer dereference flaw was only fixed in the upcoming 2.6.32 release candidate of the Linux kernel, making virtually all production versions in use at the moment vulnerable.
You know you can click on the article links and actually read them.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
I'm not a real security guy, but my experiences with security bug reporting shows that nearly all such subtle bugs are pooh-poohed by the original authors till the exploit writer resorts to petulant scaremongering. I'm not sure which one is to blame for either one's behaviour.
All of these attacks IIRC require you to be able to mmap() page zero. Which is why mmap_min_addr is almost never set low enough in a decently protected OS. But the fact is that the exploit is a valid bug for a system which hasn't got that set to 4k. And there is a valid root exploit using pulseaudio (*ouch*) as a vector.
Linus might have been right in saying setuid is a 'vulnerability', but to call it a design flaw is wrong. Setuid is not a design flaw, it is a trade-off - needed for something as simple as 'ping' to function (yeah, ping's got setuid, check it).
Being able to exploit a setuid binary after mmap'ing page zero with executable shell code, via a phpbb vulnerability which is exposed because of lack of php filtering is like saying ... "look, having arranged these six dominoes, I only need to push *one* over".
I'm not denying either of them aren't right in their own way - but invariably original author vs security researcher sets up a very immature exchange of insults (and the ego of both types don't help either).
Quidquid latine dictum sit, altum videtur
Get a Mac!!
Then it doesn't exist in karmic.
"vm.mmap_min_addr = 65536"
The bug is fixed in the release candidate. The point being that "most deployed versions" of Linux do not have the fix.
I pay very little attention to open-source politics. What's the beef between Linus and Theo? Is it just a matter of dueling egos?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Torvalds:
Am I missing something? Torvald's reply actually sounds pretty reasonable to me here. It might be nice if this exploit could be patched, but it seems a little preposterous to me that you could make that work in a way that doesn't leave an exploit. I'd say you need to be locking down your suid binaries more, not blaming kernel management.
Before people jump on Theo's comment, it's worth pointing out that it was Linus who first described the OpenBSD developers as "masturbating monkeys". That said, it's still bloody childish irrespective of who it's coming from.
... most distro maintainers seem to be doing a good job backporting fixes and features from upstream to the "mainline" kernels. At least this is true with Fedora, whose maintainers keeps cherrypicking fixes from 2.6.31 or rc for the mainline F11 2.6.30 kernels.
Colorless green Cthulhu waits dreaming furiously.
Anti-Windows people have already patched this:
For the record, this particular problem was resolved in OpenBSD a while back, in 2008. ... basically they are resisting this for Windows binary compatibility[.] Ironic, isn't it? ... We decided we don't care about Wine.
(Theo de Raadt on the OpenBSD mailing list)
:-)
Is there some sort of exploit code I can run to check if my system is vulnerable? I tried to find some online, but I only came up with some code for SCO Unix and some code that is so horrendously long that I don't dare running it for fear it might do something I don't want to happen on my system.
Please correct me if I got my facts wrong.
Editors, why troll by quoting the vocal spokesperson of a different OS to comment on a Linux problem?
I want to delete my account but Slashdot doesn't allow it.
And know the fix would be back-ported to Server 2003. How many "stable" kernel versions will the fix be back ported to? Will my 2.4.x kernels get a patch?
But the bug is not exploitable on ubuntu, because they set vm.mmap_min_addr > 0 by default.
That doesn't seem to be generally true.
Ubuntu Hardy 8.04 LTS, 2.6.24-25-generic: vm.mmap_min_addr = 65536; Ubuntu Jaunty 9.04, 2.6.28-16-generic: vm.mmap_min_addr = 0. So, by the above logic, Ubuntu Jaunty is vulnerable, although Hardy is safe.
Also seems like vm.mmap_min_addr = 0 for all the Debian boxes I can get my hands on...
(All my comments above relate to the stock/packaged kernels for the distribution)
"If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
I for one am getting royally pissed off by shards of Security Dupes as non-tech writers catch up with Security exploits.
...
All kernels have exploits. This exploit is complicated to excercise, you would need very good low-level knowledge to map page 0 then set page 0, location 0 to a valid (code *) and valid kernel code to set up the exploit, or a published HOWTO, after which any script-kiddie can do it. It was discussed on LKML and fixed in short order, a day or so AFAIR. That fix rapidly made it into the Stable Kernel series, and,
You also have to have local shell access first, to a system with compile capabilities or other no-no like ksyms radable by non-root, so yes this was exploitable but with difficulty, not like the many gaping holes in Windoze. It confuses the normal user.
I for one am much more concerned by things like continuous ssh attacks, which you can defend with iptables but really needs support in sshd.
I read Theo's comments and he's going on an on about Torvald's fixation with masturbating monkeys. Then some member of the openBSD crowd even offers a link to purchasing "your very own" **masturbating monkey** http://www.wellcoolstuff.com/Merchant2/graphics/00000001/20-Apr-07-05.jpg
Then I read Torvald's comment about the Linux exploit, with Torvald referring to the openBSD developers as being __like__ a "bunch of masturbating monkeys".
Ok, so is this like some kind of secret code used among OS kernel developers? Like saying "my shoe is blue but the cow is hungry" really means "Oh man, this code is leaking memory and crashing my system"? Or is this some kind of secret initiation thing, where in order to truly become a member of the OS development club, you have to first ... masturbate a monkey??!! Can somebody explain it, or maybe do some investigative reporting on this?
# sysctl -n vm.mmap_min_addr
0
On 9.10. Right. Did you try running the command yourself?
Getting your root access.
I regret that I only have one mod point to give per post.
Linus's comment: "That does not look like a kernel problem to me at all. He's running a setuid program that allows the user to specify its own modules. And then you people are surprised he gets local root?" Sounds reasonable to me.
The largest prime factor of my UID is 263267.
Just checked my installations (Debian with custom kernel from kernel.org). They are all at 4096 for mmap_min_addr (and hence not vulnerable), but I seem to be unable to find a place where this is set. Does anybody know whether this is the kernel default?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I've felt for a long time that giving someone local shell access to a machine is never going to be completely secure. There's just too many degrees of freedom available, and too many different things that need to be secured. This is just another proof of concept of that principle.
With all the various different interfaces we have today, shell access is something only a small percentage of people need. Even those you could likely limit down to a few administrators, some programmers, and possibly a few special cases.
AccountKiller
I could say "The... bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature."
I could compare the average time to fix a critical bug between the two platforms.
I could point out that we will never know what bugs Microsoft is sitting on without reporting.
I could point out how Windows servers just don't seem to work well if they aren't rebooted regularly while Linux boxes just seem to go until the hardware wears out.
I could point out that my wife's Vista box is 2 to 4 times faster than my Gentoo box in just about all hardware stats and yet I usually get about 10 times the framerate in games with 3D graphics.
I could point out all the hardware (printers, scanners, etc...) my Windows using friends and relatives threw out because there were no Vista drivers.
I could point out the ease of installing software with a good package manager.
I talk about the wealth of free software available for Linux (yes, some of it has Windows ports)
I could mention the price of Windows, or the prices of most of the popular software that most Windows users claim they need Windows for. (not really relevant when most people pirate it anyway though)
I might go on and on telling all sorts of true stories about Windows vs Linux but who would really want to read them.
yes, i just did and it returned 65536 :-)
The bug is fixed in the RC, but it's not exploitable in older kernels except when vm.mmap_min_addr = 0. I'm running the vanilla 2.6.30.3 kernel on Gentoo and it's not vulnerable, so it seems likely that you're only vulnerable if your distro (or you, if building a custom kernel) decided to change the default value.
*sigh* back to work...
With all the various different interfaces we have today, shell access is something only a small percentage of people need. Even those you could likely limit down to a few administrators, some programmers, and possibly a few special cases.
Right. And most machines don't run code from outside, like, oh, javascript?, flash?, java?....
Might be feeding the toll but,
Yup, randomly, anonymously taking your anger out on uninvolved bystanders is definitely the way to correct the system.
I guess it never occurred to you that you are doing the same thing that put you in your little temper tantrum to begin with.
Let's hope the people you target are more mature than you.
Mod points: Guaranteed to remove your sense of humor.
Side effects may include gullibility and temporary retardation
So it's a windows bug.
Why is this even tech news worthy? It's pretty apparent to any *NIX junkie local exploits are JUST as alarming and harmful as external service or remote kernel exploits. If you're only worried about what external threats and this article caught you by surprise, you should probably go back to the drawing board... or read less /. and learn more about the OS you're supporting. In the Linux environment I support at work, my *biggest* threat are users who know just enough how to be dangerous... and if I see any trend, it's that local exploiting and vulnerabilities should hold a bit more focus an attention, especially with the rise with the Linux desktop movement and the Ubuntu bandwagon; regardless if the user is a power-user, Linux breathing fanatic or wanted to try a Live CD, it's the exposure and curiosity that will bite you on the frontline keeping your users in check.
I'm glad I don't work with Theo de Raadt. He's a tremendous douche when he's right, and a tremendous douche when he's wrong.
“Common sense is not so common.” — Voltaire
Linus Torvalds called Theo and Developers masturbating monkeys. That is obviously an insult and insults are the last refuge of the out-argued. Insulting propositions obviously aren't logical but purely dialectical in nature. Doc Johnson and the philosopher Arthur Schopenhauer wrote about insults being the last refuge of the out-argued. Linux is not a good OS in my opinion so I use OpenBSD and NetBSD instead.
Ahhh, man. Someone mod him up "+1 originality" or "+1 Funny Troll" or something. I'm sitting in front of my StraightBuntu machine laughing my ass off. ;^)
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Just what design choice was made (wrong) by Intel, and why is it a bad choice?
now we need to go OSS in diesel cars
I might go on and on telling all sorts of FUD about Windows vs Linux but who would really want to read them.
FTFY
And yes, your FUD would be lapped up like crazy around here. This place is a troll-zoo. And apparently you're one of the star attractions.
Cmon ! Do the penguin dance !
If javascript, java, or flash is allowing you to do the kinds of things this vulnerability requires, you're already screwed.
If your browser allows outside code to execute any arbitrary code at the user level that means you're essentially 0wn3d. Being able to get root through such a vulnerability is a minor bonus.
AccountKiller
You have WINE installed. It sets the value to 0.
Functional programming... for real men!
How? Thanks.
Well, if you were to allow all user-space processes to access raw sockets, then the system might start to feel exposed and self-conscious...
Bow-ties are cool.
Linus's comment:
"That does not look like a kernel problem to me at all. He's running a setuid program that allows the user to specify its own modules. And then you people are surprised he gets local root?"
Sounds reasonable to me.
Well, here's the thing... For the exploit to work you need either mmap_min_addr to be 0, or you need your process to have CAP_SYS_RAWIO. In other words, if you were running on a system that had mmap_min_addr set to 0, you could run this exploit without already having root authority. Wine needs this, apparently...
The workaround for mmap_min_addr (by exploiting dangerous SUID code in Pulse) was just icing on the cake.
Bow-ties are cool.
Bugs like this turn up all the time and they usually get fixed before they are badly exploited, it's not newsworthy until an exploit pops up or the bug isn't fixed in a reasonable timeframe. Or are bugs like these fixed in response to news on slashdot, maybe file a bug report instead?
With all the various different interfaces we have today, shell access is something only a small percentage of people need. Even those you could likely limit down to a few administrators, some programmers, and possibly a few special cases.
Right. And most machines don't run code from outside, like, oh, javascript?, flash?, java?....
Javascript, flash, and java (on the web, I mean) are all run in environments that implement their own forms of protection. It would, therefore, be very difficult from one of these environments to do something like a null pointer exploit.
Bow-ties are cool.
It's very simple. If you're running a server, as a few pointed out here, add vm.mmap_min_addr=4096 to your /etc/sysctl.conf to protect the system on future reboots and do echo "4096" >/proc/sys/vm/mmap_min_addr to protect the system now.
If for desktop machines, consider doing the same thing but keep in mind that wine might not work if you do.
Perhaps that value should be the default, but it's not as if the fix is deeply complex or even requires a kernel update. Either way, it is a tradeoff. The various distros arguably should update sysctl.conf to fix this, but then a lot of Wine users might get very surprised.
wine
Only Win16 binaries require the ability to mmap low addresses, Win32 binaries do not. It is recommended that you test your application with the increase mmap_min_addr setting. If the application starts up without issue, then you should not need to remove the mmap_min_addr restriction.
(http://wiki.debian.org/mmap_min_addr)
/proc/sys/vm/mmap_min_addr shows 4096 on my system, and MS Word 2003 works just swell under WINE.
$ cat
My grandmother used anecdotal evidence all the time, and she lived to be 120 years old.
If anyone wants to watch these exploits being written live, you can follow spendergrsec on twitter.
http://twitter.com/spendergrsec
The rate at which spender has been cranking out kernel exploits is insane. Also it's someone who uses twitter for something for more than informing us what he's eating or when he's pooping, so that's always a plus.
Whoa. Sounds like somebody needs to "get the facts." ;)
sig: sauer
If anyone wants a choice quote from me about the recent Linux holes, this is what I have to say: Linus is too busy thinking about masturabating monkeys, he doesn't have time to care about Linux security.
Being both right and being an asshole still makes you an asshole. People can improve their perspective on technical matters by listening to those who are better informed. However, virtually no one will listen to a better informed jerk just because he's right. Linus has a good point. The user base for windows is an order of magnitude higher than Linux which is Linux has an order of magnitude higher deployment than OpenBSD. Though being more popular doesn't make any system or the people that build the system any better, it's terribly counterproductive to actively alienate the vast majority of those who could benefit a change in thinking about security by being inflammatory to any and all who don't automatically agree.
Actually, in this case, that's probably a very good piece of advice, at least with the 32-bit Mac OS X kernel. If I understand correctly, the only reason this is relevant is that in Linux and Windows, the kernel and user space have non-overlapping virtual address spaces. The Linux kernel uses a 3/1 split, the Windows kernel uses a 2/2 split (by default).
Mac OS X's 32-bit kernel, which uses a 4/4 "split" (completely overlapping address spaces), shouldn't be vulnerable because it should be impossible for code in the kernel to accidentally read data from a page mapped in a user-space process. I have no idea what the 64-bit Mac OS X kernel does in this regard.
Check out my sci-fi/humor trilogy at PatriotsBooks.
No, this article is about CVE-2009-3547.
It was these kind of issues, and the lame responses to them, that won the Linux kernel developers the 2009 Pwnie in the "Lamest Vendor Response" category.
s/Linus/Theo/g
So, anti-Windows people? Whatcha say now? ;-)
What to say about a bug that's disabled by default in the vast majority of Linux distributions, that was found before an exploit was in the wild, is already patched, and that the main reason people enable is to let them run windows applications? Ah gee, I don't know, I guess you got us there.
This space intentionally left blank.
If only there was a way to FORBID the kernel from accessing certain pointers.
Usually you want to protect the kernel from the user...
Possible fix: When switching into kernel mode, mark page zero as not present and invlpg. Any access to page 0, which btw is userspace that should be guarded with get_user et-al, would cause a fault. The exception handler, upon noticing the access was NOT done through the appropriate macro, would oops.
So the uber idiot is calling the next idiot an idiot, because of an idiot architecture... Get a job and get adult you morrons.
So, anti-Windows people? Whatcha say now? ;-)
Well I don't consider myself anti-Windows but rather a realist, by necessity. I did notice that most Linuxes are not vulnerable:
"The... bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature."
...yeah, yeah, I know, it's the programmer's fault, yada yada yada...
I am not trolling. It's time to move beyond C, to a safer programming language. C is the language of the gods: only gods can make faultless programs with it.
Comment removed based on user account deletion
Comment removed based on user account deletion
Wow, if you saw a temper tantrum there, you really need to start taking your paxil again.