Slashdot Mirror
Linux X.org Critical Security Flaw Silently Patched
eldavojohn writes "On June 17th, the X.org team was notified by Invisible Things Lab of a critical security flaw (PDF) that affected both x86_32 and x86_64 platforms. The flaw deals with escalated privileges of a user process that has access to the X server. The founder of ITL said of the flaw, 'The attack allows a (unpriviliged) user process that has access to the X server (so, any GUI application) to unconditionally escalate to root (but again, it doesn't take advantage of any bug in the X server!). In other words: any GUI application (think e.g. sandboxed PDF viewer), if compromised (e.g. via malicious PDF document) can bypass all the Linux fancy security mechanisms, and escalate to root, and compromise the whole system.' This has apparently been a security flaw since kernel 2.6 was released. From the article, 'On 13 August, Linus Torvalds committed an initial fix, but several patches were added afterward for various reasons. The problem has been addressed in versions 2.6.27.52, 2.6.32.19, 2.6.34.4 and 2.6.35.2 of the kernel.'"
It's a known fact Windows computer are full of viruses. Linux seems to be too, and it's not user friendly nor a good tool. But at least there is something different people can use - Mac. It's user friendly, you never get malware and you get things like Photoshop and a great looking UI!
Seriously, people need to stop using Windows. It is the cause for all the malware problems. I think some day Steve Jobs will do the world a great favor and change all the Windows computers to a Mac for free. People need to start seeing the real things happening around them. Mac is here to stay and win. It is the only good solution we have, because it is the only system with absolutely no malware what so ever! You can't say the same about Windows or Linux, can you?
I don't understand why people even need anything else than a Macintosh. Linux isn't going anywhere. Windows is full of viruses and is hugely losing market share to Mac's every single day. We can change the world today, but we have to do it together!
So, I'm supposed to click a link to read a PDF about a PDF flaw. You sly boots!
Xorg is a mess. Fedora had to craft a special SELinux policy, which exempted Xorg from a number of restrictions that apply to other applications (for example, the ability to unset the NX bit on a region of memory), because not only does Xorg do so many questionable things, but there is no good way to fix it. That, and the fact that Xorg runs as root, make it a particularly weak link in the chain.
Palm trees and 8
Do the Linux developers put a news announcement out every time there is a bug and they forgot about it this time?
Isn't it a little sensational to imply that Linus and the other people didn't want this bug to be known because they fear Linux will be characterized as buggy?
Because I run Windows as user SYSTEM.
1. Bug found, responsible parties notified
2. Bug fixed and software updated
3. We are protected from potential future attacks. (Profit!)
Was there an actual attack? No.
I don't read your sig. Why are you reading mine?
So they had a whole month to patch their bug, whereas Microsoft had only a week (albeit from the Google researcher)?
The author who wrote this certainly didn't count SELinux as one of the "fancy" security mechanisms...
Colorless green Cthulhu waits dreaming furiously.
I dunno about a lot of admins, but running X.org on a server seems fraught with problems aside from this recent issue. Running things that are not necessary means less of an attack surface. Didn't microsoft finally get this with its latest server products?
I'm missing something here. A PDF reader shouldn't let a PDF file anywhere near executable code, should it?
So how many distros have so far packaged this fix up and released a new kernel package?
Wow, it is a good thing that Google researcher didn't find it. Since it took two months to patch the flaw, he would have posted it. So would a bunch of these other "wah, you are taking too long" grey hat zealots. According to the group think it is never supposed to take 2 months to patch Linux and other FOSS. It's actually too bad that they didn't just do the full disclosure method after a few days like the Google guy.
Let me just open up my PDF reader and see what thi
Just a few months ago we were blasting Microsoft for taking five weeks to prepare the Ormandy patch. Now we discover that Linux has had a root-privledge exploit for years, was notified, and took two months to fix it, and we get comments like "Must be a slow day." Stay classy (and unbiased), Slashdot.
I would advise everyone to follow my lead and go back to Windows 98 to keep themselves safe
sadness And It was
I don't get this blind trust in SELinux can do what it was never intended to do. If you compromise the kernel - especially a monolithic kernel like Linux - it really is game over.
Practically every security check (and - yes - that includes SELinux extra hooks) are performed before the actual operation is performed with no kernel lock covering both. Which means that *all* of them are susceptible to concurrent access attacks.
It works like this: The malicious code invokes the syscall passing a structure, e.g. an inode but at the same time the malicious code starts a second thread which after a measured period (clockcycles) modifies the very same structure. By crafting this carefully the attacker can hit the "weak spot" between the security checks and the actual operation. It doesn't work every time due to obvious nondeterminism, but even a 30% hit rate will be exceptionally good in a mass attack.
And you cannot lock down the tools used in this scenario. All processes will need to access memory and spawn threads. Certainly browsers, X servers, pdf readers etc. do.
This is not a bug in the kernel. Avoiding this weakness would involve bigger locks and critical sections which would seriously impede scalability. It is just that the kernel was never designed to withstand attacks from within the kernel itself.
So please stop peddling SELinux as a silver bullet. Once an attacker is inside the kernel it really is game over. SELinux doesn't fix that. Nor was it intended to.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Yes, Linux has security bugs. Yes, Windows has security bugs. Yes Mac has them too.
As an internet user if I use for daily surfing without all sorts of virus and adware protection how likely am I to get garbage on it that slows it down and fouls my surfing experience? How about the likelihood of getting something truly malicious which makes things stop working altogether or worse yet steals my data? Is there such a thing as virus and adware protection which does not bog the computer down all by itself? Be honest and ask yourself about this for all three of them.
I've used Linux and Windows quite a bit and I can say for sure that if you use them on the internet the Windows machine is extremely likely to get filled with garbage and need formatting in a few months at best. While bad things could happen in Linux they normally do not. Sorry, I know there is such a thing as a Linux virus but I have never seen one. I've seen plenty on Windows. I don't care that technically a hack is possible or a virus exists somewhere if the probability it will ever reach me is near zero.
Now, Mac... It's probably about the same as Linux as far as safety goes. Why would I want to pay twice as much for my computer though? And it's GUI, sorry, no matter how many self described artsy fanbois tell me it's sexy I still think it's butt ugly. Easy to use? How so? All the common programs have 'shortcuts' in the dock. I have to navigate something named 'my harddrive' to find the rest? Really? Is that thing the actual hard drive contents or some collection of shortcuts or what anyway? What's inside here, applications, data files, library files I don't want to know about? Please, give me a 'start' button anyday better yet, how about a nice big 'K' menu. And the dock is also the pager? Running, minimized programs and 'shortcuts' pretty much look the same down there! I guess for stupid people who don't know the difference between a program running or just being installed that does make it easy. They don't have to strain their precious heads learning about a computer. I suppose this is ok when all you ever run is your browser. I'd rather know what's running so I can close it if the computer starts to get bogged down thank you. No, I don't like that paradigm in cellphone OSs either. Hmm... I wonder how long before Mac users can only install the programs big brother Jobs approves of like the iPhone? On the bright side I suppose you don't have to worry some cracker is going to own your computer when the company you bought it from already does!
any implementation of an X server has been full of holes and dangers, only an idiot runs X server on a server. Learn the command line, you pussies! Run X server somewhere else!
Honestly, if you're having to reformat Windows every few months, it's a user problem.
Here is a novel idea: Stop misrepresenting what actually happened and stop ad hominem attacks questioning posters' motives .
Microsoft took five weeks to prepare the Ormandy patch. During that time, they made no comment - there was no transparency into whether or not it would be fixed.
They made no comments? Did you actually look or did you just assume?
Now to your claim that they "made no comments":
Hardly a "no comments" approach. If you click through those posts I think you'll find them smack full of info. And I've even excluded their communication on the preliminary "fix it" tools.
Admit it. You are biased, but not classy.
Like your misrepresentation and ad hominem demonstrate more class?
It seems to me that it is indeed interesting that this fix was 2 months in the making (responsibly disclosed). And that is only measuring the time until the kernel had been fixed. Now the distros would have to pick up on it and perform their own regression testing, prepare packages/updates etc.
GP did raise some really interesting questions. For some reason you chose to disregard them right away and go straight for the mans posting history.
Will you be publishing stats on my posting history as well. Am I a shill, too?
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
OS X (and even Windows) is far more secure than Linux. In fact, OS X is the gold standard of security, with added benefits of being more usable, faster, and more free than Linux (Apple releases Darwin under the BSD license, not the viral, anti-corporate GPL). Remind me again why anyone bothers with the pile of steaming crap that is lin-$ux?
Agreed. I only have to install my personal copy of XP once: when I build my new system.
My current install is from 26 Jun, 2008, not coincidentally the day I put together my current system.
There's still a hole. See Xorg Large Memory Attacks, section 4. Opening a one-page gap in mapped memory at the top of the stack is a workaround, not a fix.
This looks like bad design. Someone got too cute with the MMU. The basic problem is shared memory between a privileged and a non-privileged program. That just screams "security hole". It was put in to get a performance advantage for graphics-heavy applications on X, probably games. "MIT-SHM" shouldn't be enabled on a production server.
Your posts are merely proving OP wrong. Because Odies asked : "Do you honestly think that Microsoft would do nothing if there was a non-patched privilege escalation exploit in Windows?"
You've counted 10.
That would, by the way, be 10 WE KNOW ABOUT.
Now, unless you have windows source and have tested it as thoroughly as devs tested X.Org code, you cannot say there are NO more vulnerabilities.
But can you count how many there are?
No.
Therefore, since they can't be counted, what are they?
Countless.
I'm confused by the comments saying X can only be run as root.
I'm running it just fine on a couple of my systems by calling startx as a normal user.
Obviously I'm missing something here, but I'm not sure what... Is it something to do with the way drivers work?
Check on the linux kernel audit project. It exists, does things like static code analysis and audits most of the code changes for security vulnerabilities. In that last 5+ years they have fixed hundreds to thousands of security vulnerabilities - all silently. It is an official policy of the core developers to handle every security problem via obscurity in short time frame.
The changelog indeed is a gold mine. You can at any point of time find fresh vulnerabilities by tracking it. That leads to every installed and running Linux kernel out there having exploitable known vulnerabilities that have not yet been patched. Every black hat that is interested in Linux kernel knows this and exploits it daily.
Must Not Happen
Thanks for the simple and short explanation.
By default the hard drive (the boot partition, in fact) is called "Macintosh HD". When you click on it you are at the root mount point ( / ) containing the familiar Users, Applications, Library, System that will be familiar to anyone who used a Unix or Linux system before.
If you want to navigate to other programs not on the Dock, just click "Applications" (also in the dock) for a pop-up list, much like the start menu (it just doesn't say "start" on it). Different modifier keys that you can optionally press when you click this representation of your Applications folder [that is much like the Start button] vary the way it displays - like a fan, like a grid or like a regular list, depending on your preference. The number of apps that have "shortcuts" in the Dock is entirely up to you - you can keep it just to running apps if you really want (with the exception of Finder and the Trash, which you cannot remove, although since the Finder is always running it will always display in the Dock anyway [although you can modify the behaviour so you can quit Finder, you cannot remove it from the far left anchor position on the dock]). Putting apps that you very frequently use in the Dock reduces the launch method to a single click, but you are not obligated to do this. You can tell at a glance what apps are running since they have a big white dot under them if you do choose to keep non-running apps in the Dock. It speaks to your character that you think a different UI paradigm means the entirety of its users are stupid; that's one of the biggest non-sequiturs I have ever seen, although that's closely followed by the assertion that Mac users only run a browser.
The Mac user space is set up very similarly to Linux - home folder, apps folder, system folders etc. All of the "data files and library files" are kept separately in logical places. If you are levelling this criticism at the Mac then surely you must do the same for Linux, since the layout is near-identical.
The fact that you don't personally like the Mac UI doesn't make it some hopeless, inferior method of computer interface - just different. There are enough errors and I-don't-want-to-like-it bias in your post (ie, from someone who uses a Linux system day to day, you are either being wilfully ignorant about some really basic things or you have never actually used a Mac and are just repeating things you have read second hand - if you are proficient with a Linux system, the Mac UI and HD layout is not rocket science).
Also, formatting a Windows box every few months? This is not 1995 any more. XP, 7 and (shock horror) even Vista are not that bad any more if they are properly looked after. This does mean AV software for Windows, but there is no need for it to be giant bloatware.
With the switch to kernel modesetting (already happening) there shouldn't be any need for X to mess directly with hardware anymore, and without that it should run just fine without root privileges.
But that just means the X server will be running as something other than root. Doesn't fix the basic problem - which is that any client can use the X server bug to gain the privilege of the X server's account.
If the X server is running as the same account as the client it's not such a big deal. But even if the server is running as the user who is working with the desktop, the client might be something that the user wanted to sandbox into some other account (or otherwise restrict its access, i.e. by limits, chroot, ...). This means it can still break out and corrupt his stuff by seizing the X server's privileges.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Workdays was important because that is what was used in the responsible disclosure guidelines. Which recommends waiting 5 workdays of non-communication before taking a vulnerability public.
Responsible disclosure which Google strongly supported until one of their researchers broke it:
From Googles website (emphasis mine):
"This process of notifying a vendor before publicly releasing information is an industry standard best practice known as responsible disclosure. Responsible disclosure is important to the ecology of the Internet. It allows companies like Google to better protect our users by fixing vulnerabilities and resolving security concerns before they are brought to the attention of the bad guys. We strongly encourage anyone who is interested in researching and reporting security issues to observe the simple courtesies and protocols of responsible disclosure. Our Security team follows the same procedure when we discover and report security vulnerabilities to other companies.
Tavis Ormandy knew this. That is why he made a stupid claim that acted in his personal capacity, not as a Google researcher. Even though he used Google resources, Google colleagues and Google paid time.
Also I see no technical discussion of the problem on any of the links you posted, nor any steps that can be taken until MS gets a update out to fix it.
The technical info is there. If you cared to follow the "fix it" links from their blog entries you would see that they designed workarounds.
But the interesting thing here is that after this debacle, 60 days was put forward as an absolute maximum a vendor should spend analyzing and designing+implementing a fix for a vulnerability. With this Linux bug we see 2 groups need to sit down together to work things out. And they spend 60 days before the distros got their hand on the fix. Just interesting, that's all. This was pointed out by the GP of the post I responded to. And he was immediately attacked.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Although everyone "slags off" Symbian (really the S60 UI) and declares "Android forever" and all that crap. it has a microkernel OS with File Servers and the rest - EKA2.
http://media.wiley.com/product_data/excerpt/47/04700252/0470025247.pdf
It's out there on hundreds of millions of devices too, and whatever you might say about the UIs ontop of it, it is pretty good in itself.
This is all just my personal opinion.
Allow me to analyze your assumptions:
Microsoft has thousands of programmers working full-time; Linux is maintained by volunteers, working in their spare time.
How many volunteers, compared to the number of Microsoft programmers? If the volunteers each work one tenth of full time per week but there are twenty times as many of them as there are Microsoft programmers, how does the math come out?
That means that Microsoft can easily allocate more resources to fixing a security bug than Linux can.
I see a type error: Microsoft is an organization, Linux is one or more pieces of software; they seem to not have an "allocate resources" behavior in common. So---who is this "Linux" you speak of? Do you mean Red Hat? Canonical? The Debian project? The collection of hobbyists living in their moms' basements? How does this resource-allocating-Linux-thing allocate its resources? How do you know how easily it does it, and how many resources it has?
This being true, you'd expect Microsoft to get bug patches out quicker than Linux
This assumes that more input resources yields more output results. That's not true, not even in just all the non-degenerate cases (For a controversial example, compare health care systems for price and quality across nations).
the Microsoft patches come out only on Patch Tuesday, while the Linux patches come out as quickly as the various distros fold them into their updates.
How quick are those two time spans compared to one another, on average? (Pick your sample any way you want, as long as you discuss what might be wrong about your sampling method)
And, if that's not fast enough for you, you can always download the source and compile it for yourself
Assuming you have the time and skills to do so. (If you believe it takes virtually no skills, I guess you don't do tech support for family and friends)
The fact that you don't personally like the Mac UI doesn't make it some hopeless, inferior method of computer interface - just different. There are enough errors and I-don't-want-to-like-it bias in your post (ie, from someone who uses a Linux system day to day, you are either being wilfully ignorant about some really basic things or you have never actually used a Mac and are just repeating things you have read second hand - if you are proficient with a Linux system, the Mac UI and HD layout is not rocket science).
Not rocket science, but quite unintuitive even to a ten year long linux user who's used to doing things at times in odd ways.
Perfect example being installing the firefox dmg on mac os, I tested this with multiple people, so it wasn't just me being a retard. Clicking the dmg to open the window is natural, most people then wait for some kind of installer option if they are used to windows or some kind of direction if used to linux.
Clicking and dragging the little icon to install something is completely non-intiutive to non-mac people. Most just gave up.
Just one example of many, and as a linux user I'd actually use windows over mac os x, because when I drop into an os x shell it's almost useless by default and can take quite some time to install all the typical cli applications required.
Windows is no different in that regard however at least in windows you know where you stand from the start.
Yes, except the basic problem was fixed in the kernel so whether the X server runs as root or not is irrelevant.
White dot? There was no white dots to show running applications when I worked in an office w/ Macs. That was a few years ago though. Maybe they added it? Or maybe there is a setting? Everything was set to the bosses preferences and locked down tight. If Mac doesn't try to hide the difference between running and not-running programs then I apologize for that remark. I do think that UIs which work that way (I have seen it on cellphones) work that way to insulate the user from needing a basic computer understanding... Thus the 'stupid' remark.
OK, Windows is better than it was. I'll give that. Running an anti-virus program though is a big negative. I'm sorry, I have yet to see a machine that didn't bog down and run like crap whenever an antivirus was installed. Disabling heuristic scans and limiting file types to actual executable helps but doesn't really fix the problem. Windows also has a tendency to acrue garbage if you install and remove programs regularly. No, I'm not talking about applications containing malware. Install a number of well trusted applications and remove them. Windows will run slower.
Sure.. I do see some Unix heritage in the Mac filesystem. That's great when doing something involved from the commandline. I don't think I should need to go there to run an application though. Maybe there is a menu option which was disabled in the machines I used? I didn't see a way to separate the concept of shortcuts to the executable files of applications and just viewing the actual directory structure.
Ignoring all this functionality stuff even just on an aesthetics basis I think it is just fine for me to state the Mac's UI is butt ugly and inferior. Sure, appearances are subjective but these days it seems like it is almost assumed to be a universal opinion that Mac has the prettiest UI. I'm just making the point that there is at least one person still alive who disagrees.