Slashdot Mirror
Bug In Most Linuxes Can Give Untrusted Users Root
Red Midnight and other readers brought to our attention a bug in most deployed versions of Linux that could result in untrusted users getting root access. The bug was found by Brad Spengler last month. "The null pointer dereference flaw was only fixed in the upcoming 2.6.32 release candidate of the Linux kernel, making virtually all production versions in use at the moment vulnerable. While attacks can be prevented by implementing a common feature known as mmap_min_addr, the RHEL distribution... doesn't properly implement that protection... The... bug is mitigated by default on most Linux distributions, thanks to their correct implementation of the mmap_min_addr feature. ... [Spengler] said many other Linux users are also vulnerable because they run older versions or are forced to turn off [mmap_min_addr] to run certain types of applications." The register reprints a dialog from the OpenBSD-misc mailing list in which Theo De Raadt says, "For the record, this particular problem was resolved in OpenBSD a while back, in 2008. We are not super proud of the solution, but it is what seems best faced with a stupid Intel architectural choice. However, it seems that everyone else is slowly coming around to the same solution."
But you don't know if I didn't just hack the servers ;)
So, anti-Windows people? Whatcha say now? ;-)
Surely this is the same story, from 2 months ago.
fixed that for u.
Everyone knows that....don't they?
So, anti-Windows people? Whatcha say now? ;-)
Thank god that independent forces are out there finding and reporting kernel bugs in Linux. If only the bug-finders for windows were so altruistic.
...they should've listened to Linus and ignored this until now, like all the others. Linus knows best.
I'd been using Ubuntu 9.04's LiveCD feature at work to migrate Windows profiles. Unlike Windows, which never properly migrates user directories no matter how you coax it, Ubuntu's simple drag-and-drop replacement from network backup makes user migration a piece of cake.
I simply booted, configured the network settings, logged into our network backup, and copied the old user directory over top of the new one (we're on a domain). When the user logged back in, their old stuff was all in place. It had really been a lifesaver, and I'd started reading up on it more and started to set up an Ubuntu workstation. But that's when I ran into some weird problems.
After installing and tinkering around on the GNOME desktop, I opened Terminal. After writing some scripts and creating user accounts, a new terminal window opened. I thought this very odd since I hadn't initiated a new session and none of my scripts would have either. As I was about to close it, I paused my mouse. The terminal session had printed something to the screen, seemingly by itself.
trollaxor@ubuntor:~$
*** DO U LIKE GUYS Y OR N
I typed N and the window disappeared. "How weird," I thought, and figured one of my buddies had installed some third party software or something to covertly mess with me. I couldn't remember when I'd told anyone about this install, but I was content to leave it at that since everything was otherwise fine.
A half hour later, I was farting around in GNOME when it happened again. This time, there was no terminal session even open to begin with; the window just popped up out of nowhere. And again it asked the same question, ominously blinking at me.
trollaxor@ubuntor:~$
*** DO U LIKE GUYS Y OR N
Before I did anything else I opened another terminal session and ran top so I could figure out what the fuck was running in the background that was randomly harassing me. I peered through it, sorted by CPU, memory usage, command name—but nothing. I'm pretty familiar with Linux and I didn't see anything that looked out of the ordinary. At this point I switched back to the frustrating terminal session and typed N and the window closed Only to open right back up and ask again:
trollaxor@ubuntor:~$
*** DO U LIKE GUYS Y OR N
Now irritated, I texted several of my buddies the same question, figuring they'd own up when it became obvious to them their little joke had succeeded. Two asked me "wtf" and another said "no y do u? fag!" No admissions came, implicit or otherwise, and I began running ps with its myriad options in hopes of spotting the offending process. A second terminal window popped up on top of the first with the same damn question blinking at me.
trollaxor@ubuntor:~$
*** DO U LIKE GUYS Y OR N
Finally in desperation I typed Y and hit return in both of the windows. At first, they went away and I sat silently in anticipation. When nothing happened after ten seconds, I returned to editing my GNOME config files when the desktop wallpaper changed all by itself. Instead of the boring orange default, I was staring at something much different. This was no longer mildly irritating or perplexing—now I was freaking out and wanted answers. I logged onto Freenode and joined #ubuntu.
#ubuntu Official Ubuntu Support Channel
hi. i was wondering if anyone ever noticed any versions of ubuntu throwing up terminal sessions with text inside.
Minutes passed as conversations about screen resolution problems on netbooks, laptop fans running non-stop, and permissions errors on an external USB drives ran back and forth—typical IRC chatter—but someone eventually responded to my question.
trollaxor, it's possible but unlikel
Is it just my observation, or is eldavojohn an idiot?
The lead in says its "a bug in most deployed versions of Linux"
Then says in the excerpt " in the upcoming 2.6.32 release candidate of the Linux kernel"
Its a release candidate, therefore it cant be in "most deployed versions".
The newest version of Ubuntu (karmic) for instance only uses 2.6.31.
I trust Microsoft as far as I could comfortably spit a dead rat
The bug was found by Brad Spengler last month.
I thought we discussed this in July? Or is this a different exploit?
I think it's pretty clear that De Raadt and others have been discussing this vulnerability for quite sometime. On a list of affected systems, you can see it's been known on that site since August. Here's another fix discussed that involves setting PER_CLEAR_ON_SETID mask to MMAP_PAGE_ZERO and that's from July (unfortunately, as the Register article said, that might cause problems with applications). In fact I think Spengler has been talking about this for quite sometime as I believe you can find exploit code here and a video of it in use here against SELinux. If that's not the same exploit it sure seems to be very similar in nature.
My work here is dung.
For those who just want to know how to fix it, you need to apply this git commit to your kernel tree and then either recompile and reboot or apply the patch using ksplice.
If the result is non-zero the vulnerability doesn't exist.
'Most deployed versions of linux'?.
So far only some unpatched RHEL versions allow this local exploit, even the Centos rip-off doesn't have it.
Surely this is the same story, from 2 months ago.
One word: "Kdawson"
Linux is teh roxerz!!!!onehundredeleven!!!
M$ wants to p0wn3d joo.
The null pointer dereference flaw was only fixed in the upcoming 2.6.32 release candidate of the Linux kernel, making virtually all production versions in use at the moment vulnerable.
You know you can click on the article links and actually read them.
I only look human.
My mother is a halfling and my dad is an ogre, so that makes me an Ogreling
I'm not a real security guy, but my experiences with security bug reporting shows that nearly all such subtle bugs are pooh-poohed by the original authors till the exploit writer resorts to petulant scaremongering. I'm not sure which one is to blame for either one's behaviour.
All of these attacks IIRC require you to be able to mmap() page zero. Which is why mmap_min_addr is almost never set low enough in a decently protected OS. But the fact is that the exploit is a valid bug for a system which hasn't got that set to 4k. And there is a valid root exploit using pulseaudio (*ouch*) as a vector.
Linus might have been right in saying setuid is a 'vulnerability', but to call it a design flaw is wrong. Setuid is not a design flaw, it is a trade-off - needed for something as simple as 'ping' to function (yeah, ping's got setuid, check it).
Being able to exploit a setuid binary after mmap'ing page zero with executable shell code, via a phpbb vulnerability which is exposed because of lack of php filtering is like saying ... "look, having arranged these six dominoes, I only need to push *one* over".
I'm not denying either of them aren't right in their own way - but invariably original author vs security researcher sets up a very immature exchange of insults (and the ego of both types don't help either).
Quidquid latine dictum sit, altum videtur
Then it doesn't exist in karmic.
"vm.mmap_min_addr = 65536"
People who spend their lives looking for exploits and holes in a system whether white or black hat are only doing it so they can puff their egos by getting one over the codes original author and showing the world how l337 they are , so no great surprise when said egos bloat out in arguments.
I pay very little attention to open-source politics. What's the beef between Linus and Theo? Is it just a matter of dueling egos?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Torvalds:
Am I missing something? Torvald's reply actually sounds pretty reasonable to me here. It might be nice if this exploit could be patched, but it seems a little preposterous to me that you could make that work in a way that doesn't leave an exploit. I'd say you need to be locking down your suid binaries more, not blaming kernel management.
Before people jump on Theo's comment, it's worth pointing out that it was Linus who first described the OpenBSD developers as "masturbating monkeys". That said, it's still bloody childish irrespective of who it's coming from.
... most distro maintainers seem to be doing a good job backporting fixes and features from upstream to the "mainline" kernels. At least this is true with Fedora, whose maintainers keeps cherrypicking fixes from 2.6.31 or rc for the mainline F11 2.6.30 kernels.
Colorless green Cthulhu waits dreaming furiously.
Is there some sort of exploit code I can run to check if my system is vulnerable? I tried to find some online, but I only came up with some code for SCO Unix and some code that is so horrendously long that I don't dare running it for fear it might do something I don't want to happen on my system.
Please correct me if I got my facts wrong.
Editors, why troll by quoting the vocal spokesperson of a different OS to comment on a Linux problem?
I want to delete my account but Slashdot doesn't allow it.
And know the fix would be back-ported to Server 2003. How many "stable" kernel versions will the fix be back ported to? Will my 2.4.x kernels get a patch?
But the bug is not exploitable on ubuntu, because they set vm.mmap_min_addr > 0 by default.
That doesn't seem to be generally true.
Ubuntu Hardy 8.04 LTS, 2.6.24-25-generic: vm.mmap_min_addr = 65536; Ubuntu Jaunty 9.04, 2.6.28-16-generic: vm.mmap_min_addr = 0. So, by the above logic, Ubuntu Jaunty is vulnerable, although Hardy is safe.
Also seems like vm.mmap_min_addr = 0 for all the Debian boxes I can get my hands on...
(All my comments above relate to the stock/packaged kernels for the distribution)
"If you think the problem is bad now, just wait until we've solved it." --- Arthur Kasspe
I for one am getting royally pissed off by shards of Security Dupes as non-tech writers catch up with Security exploits.
...
All kernels have exploits. This exploit is complicated to excercise, you would need very good low-level knowledge to map page 0 then set page 0, location 0 to a valid (code *) and valid kernel code to set up the exploit, or a published HOWTO, after which any script-kiddie can do it. It was discussed on LKML and fixed in short order, a day or so AFAIR. That fix rapidly made it into the Stable Kernel series, and,
You also have to have local shell access first, to a system with compile capabilities or other no-no like ksyms radable by non-root, so yes this was exploitable but with difficulty, not like the many gaping holes in Windoze. It confuses the normal user.
I for one am much more concerned by things like continuous ssh attacks, which you can defend with iptables but really needs support in sshd.
I read Theo's comments and he's going on an on about Torvald's fixation with masturbating monkeys. Then some member of the openBSD crowd even offers a link to purchasing "your very own" **masturbating monkey** http://www.wellcoolstuff.com/Merchant2/graphics/00000001/20-Apr-07-05.jpg
Then I read Torvald's comment about the Linux exploit, with Torvald referring to the openBSD developers as being __like__ a "bunch of masturbating monkeys".
Ok, so is this like some kind of secret code used among OS kernel developers? Like saying "my shoe is blue but the cow is hungry" really means "Oh man, this code is leaking memory and crashing my system"? Or is this some kind of secret initiation thing, where in order to truly become a member of the OS development club, you have to first ... masturbate a monkey??!! Can somebody explain it, or maybe do some investigative reporting on this?
Getting your root access.
I regret that I only have one mod point to give per post.
Linus's comment: "That does not look like a kernel problem to me at all. He's running a setuid program that allows the user to specify its own modules. And then you people are surprised he gets local root?" Sounds reasonable to me.
The largest prime factor of my UID is 263267.
Just checked my installations (Debian with custom kernel from kernel.org). They are all at 4096 for mmap_min_addr (and hence not vulnerable), but I seem to be unable to find a place where this is set. Does anybody know whether this is the kernel default?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I've felt for a long time that giving someone local shell access to a machine is never going to be completely secure. There's just too many degrees of freedom available, and too many different things that need to be secured. This is just another proof of concept of that principle.
With all the various different interfaces we have today, shell access is something only a small percentage of people need. Even those you could likely limit down to a few administrators, some programmers, and possibly a few special cases.
AccountKiller
With all the various different interfaces we have today, shell access is something only a small percentage of people need. Even those you could likely limit down to a few administrators, some programmers, and possibly a few special cases.
Right. And most machines don't run code from outside, like, oh, javascript?, flash?, java?....
So it's a windows bug.
Why is this even tech news worthy? It's pretty apparent to any *NIX junkie local exploits are JUST as alarming and harmful as external service or remote kernel exploits. If you're only worried about what external threats and this article caught you by surprise, you should probably go back to the drawing board... or read less /. and learn more about the OS you're supporting. In the Linux environment I support at work, my *biggest* threat are users who know just enough how to be dangerous... and if I see any trend, it's that local exploiting and vulnerabilities should hold a bit more focus an attention, especially with the rise with the Linux desktop movement and the Ubuntu bandwagon; regardless if the user is a power-user, Linux breathing fanatic or wanted to try a Live CD, it's the exposure and curiosity that will bite you on the frontline keeping your users in check.
I'm glad I don't work with Theo de Raadt. He's a tremendous douche when he's right, and a tremendous douche when he's wrong.
“Common sense is not so common.” — Voltaire
Linus Torvalds called Theo and Developers masturbating monkeys. That is obviously an insult and insults are the last refuge of the out-argued. Insulting propositions obviously aren't logical but purely dialectical in nature. Doc Johnson and the philosopher Arthur Schopenhauer wrote about insults being the last refuge of the out-argued. Linux is not a good OS in my opinion so I use OpenBSD and NetBSD instead.
Just what design choice was made (wrong) by Intel, and why is it a bad choice?
now we need to go OSS in diesel cars
If javascript, java, or flash is allowing you to do the kinds of things this vulnerability requires, you're already screwed.
If your browser allows outside code to execute any arbitrary code at the user level that means you're essentially 0wn3d. Being able to get root through such a vulnerability is a minor bonus.
AccountKiller
How? Thanks.
Well, if you were to allow all user-space processes to access raw sockets, then the system might start to feel exposed and self-conscious...
Bow-ties are cool.
Linus's comment:
"That does not look like a kernel problem to me at all. He's running a setuid program that allows the user to specify its own modules. And then you people are surprised he gets local root?"
Sounds reasonable to me.
Well, here's the thing... For the exploit to work you need either mmap_min_addr to be 0, or you need your process to have CAP_SYS_RAWIO. In other words, if you were running on a system that had mmap_min_addr set to 0, you could run this exploit without already having root authority. Wine needs this, apparently...
The workaround for mmap_min_addr (by exploiting dangerous SUID code in Pulse) was just icing on the cake.
Bow-ties are cool.
Bugs like this turn up all the time and they usually get fixed before they are badly exploited, it's not newsworthy until an exploit pops up or the bug isn't fixed in a reasonable timeframe. Or are bugs like these fixed in response to news on slashdot, maybe file a bug report instead?
With all the various different interfaces we have today, shell access is something only a small percentage of people need. Even those you could likely limit down to a few administrators, some programmers, and possibly a few special cases.
Right. And most machines don't run code from outside, like, oh, javascript?, flash?, java?....
Javascript, flash, and java (on the web, I mean) are all run in environments that implement their own forms of protection. It would, therefore, be very difficult from one of these environments to do something like a null pointer exploit.
Bow-ties are cool.
It's very simple. If you're running a server, as a few pointed out here, add vm.mmap_min_addr=4096 to your /etc/sysctl.conf to protect the system on future reboots and do echo "4096" >/proc/sys/vm/mmap_min_addr to protect the system now.
If for desktop machines, consider doing the same thing but keep in mind that wine might not work if you do.
Perhaps that value should be the default, but it's not as if the fix is deeply complex or even requires a kernel update. Either way, it is a tradeoff. The various distros arguably should update sysctl.conf to fix this, but then a lot of Wine users might get very surprised.
wine
Only Win16 binaries require the ability to mmap low addresses, Win32 binaries do not. It is recommended that you test your application with the increase mmap_min_addr setting. If the application starts up without issue, then you should not need to remove the mmap_min_addr restriction.
(http://wiki.debian.org/mmap_min_addr)
/proc/sys/vm/mmap_min_addr shows 4096 on my system, and MS Word 2003 works just swell under WINE.
$ cat
My grandmother used anecdotal evidence all the time, and she lived to be 120 years old.
If anyone wants to watch these exploits being written live, you can follow spendergrsec on twitter.
http://twitter.com/spendergrsec
The rate at which spender has been cranking out kernel exploits is insane. Also it's someone who uses twitter for something for more than informing us what he's eating or when he's pooping, so that's always a plus.
If anyone wants a choice quote from me about the recent Linux holes, this is what I have to say: Linus is too busy thinking about masturabating monkeys, he doesn't have time to care about Linux security.
Being both right and being an asshole still makes you an asshole. People can improve their perspective on technical matters by listening to those who are better informed. However, virtually no one will listen to a better informed jerk just because he's right. Linus has a good point. The user base for windows is an order of magnitude higher than Linux which is Linux has an order of magnitude higher deployment than OpenBSD. Though being more popular doesn't make any system or the people that build the system any better, it's terribly counterproductive to actively alienate the vast majority of those who could benefit a change in thinking about security by being inflammatory to any and all who don't automatically agree.
No, this article is about CVE-2009-3547.
It was these kind of issues, and the lame responses to them, that won the Linux kernel developers the 2009 Pwnie in the "Lamest Vendor Response" category.
s/Linus/Theo/g
If only there was a way to FORBID the kernel from accessing certain pointers.
Usually you want to protect the kernel from the user...
Possible fix: When switching into kernel mode, mark page zero as not present and invlpg. Any access to page 0, which btw is userspace that should be guarded with get_user et-al, would cause a fault. The exception handler, upon noticing the access was NOT done through the appropriate macro, would oops.
So the uber idiot is calling the next idiot an idiot, because of an idiot architecture... Get a job and get adult you morrons.
...yeah, yeah, I know, it's the programmer's fault, yada yada yada...
I am not trolling. It's time to move beyond C, to a safer programming language. C is the language of the gods: only gods can make faultless programs with it.
Comment removed based on user account deletion
Comment removed based on user account deletion