Slashdot Mirror
RDS Protocol Bug Creates a Linux Kernel Hole, Now Fixed
Trailrunner7 writes "The open-source Linux operating system contains a serious security flaw that can be exploited to gain superuser rights on a target system. The vulnerability, in the Linux implementation of the Reliable Datagram Sockets (RDS) protocol, affects unpatched versions of the Linux kernel, starting from 2.6.30, where the RDS protocol was first included." The article goes on to say, though, that "Linux installations are only vulnerable if the CONFIG_RDS kernel configuration option is set, and if there are no restrictions on unprivileged users loading packet family modules, as is the case on most stock distributions," and that Linus Torvalds has committed a fix.
They should mention in the summary this is a local privilege escalation exploit only.
It must piss him off to no end when people add broken features like this to his operating system.
Are we going to start putting "now fixed" on all articles where it applies, or just Linux ones? I see how it is.
Cue the "well, nobody uses that" defense.
Reliable Datagram Sockets (RDS) provide in order, non-duplicating, highly available, low overhead, reliable delivery of datagrams between hundreds of thousands of non-connected endpoints."
/etc/modprobe.d/disable-rds
Gives new meaning...
Recommendation:
Users should install updates provided by downstream distributions or apply the committed patch [3] and recompile their kernel.
Preventing the RDS kernel module from loading is an effective workaround. This can be accomplished by executing the following command as root:
echo "alias net-pf-21 off" >
He who knows best knows how little he knows. - Thomas Jefferson
An explanation of what the exploit is, is not excuse.
All modern OS have these problems, the reality is we get speed or security and everyone has chosen speed. Maybe in 40 more years we will have the cpu cycles to waste.
If you release early and you release often, you will release a big piece of sh^H^H code with a lot of bugs.
Funny how Microsoft releases late and releases seldom and has the same problem...
"Maybe this world is another planet's hell"
Aldous Huxley
2.2.26 is still working great for me, thanks!
slashdot = stagnated
Until the fix was sent out to everyone. Even though Apple and MS people find something like this with Linux, the issue is immediately fixed and distributed overnight rather then waiting for a committee from Microsoft to fix the problem months from now.
Nope. The usual Microsoft nonsense is still alive and well in 2010.
A Pirate and a Puritan look the same on a balance sheet.
The same article announcing the existence of the exploit announced the existence of the fix. That's pretty good support if you ask me, and it's hard to be too worried under those circumstances.
Yeah, it's 2010, and every Tuesday my computer bitches about how I have updates waiting to be installed...
:(){
Was this vulnerability fixed in yesterday's massive security update?
``Tension, apprehension & dissension have begun!'' - Duffy Wyg&, in Alfred Bester's _The Demolished Man_
I am running the 2.6.36 kernel (issued yesterday). Now I've had a lot of security updates in the past couple of days, but I can confirm that I *do* compile RDS into the kernel: ...and so I thought: well, lets try this out, so I got the exploit, and compiled it: ...and then ran it as an ordinary user: ....and so it didn't work. Just for hoots and hollers I log in as root (Ubuntu normally wants people to use sudo everywhere, but I always get around that in about 20 seconds usually right after install) ...There were 2 massive security updates yesterday, and I see another set just popped onto the toolbar here a few minutes ago, and I'll probably run them in a sec, they only take a minute and its not like you have to stop what you are doing for them or anything. I wonder if they kept RDS exploits from being any kind of news?
CONFIG_RDS=m
CONFIG_RDS_RDMA=m
CONFIG_RDS_TCP=m
# CONFIG_RDS_DEBUG is not set
gcc rds.c -o rds
[*] Linux kernel >= 2.6.30 RDS socket exploit
[*] by Dan Rosenberg
[*] Resolving kernel addresses...
[+] Resolved rds_proto_ops to 0xffffffffa0c7f8a0
[+] Resolved rds_ioctl to 0xffffffffa0c78000
[+] Resolved commit_creds to 0xffffffff810771c0
[+] Resolved prepare_kernel_cred to 0xffffffff81077690
[*] Overwriting function pointer...
[*] Triggering payload...
[*] Restoring function pointer...
[*] Exploit failed to get root.
so as root I re-ran it:
[*] Linux kernel >= 2.6.30 RDS socket exploit
[*] by Dan Rosenberg
[*] Resolving kernel addresses...
[+] Resolved rds_proto_ops to 0xffffffffa0c7f8a0
[+] Resolved rds_ioctl to 0xffffffffa0c78000
[+] Resolved commit_creds to 0xffffffff810771c0
[+] Resolved prepare_kernel_cred to 0xffffffff81077690
[*] Overwriting function pointer...
[*] Triggering payload...
[*] Restoring function pointer...
[*] Got root!
# exit
(but I already *was* root, so its not really a 'got it' but more of a 'have it').
Here is the video! http://www.youtube.com/watch?v=5gwGcP8QbH8
Brilliant!
Of course what you don't know is that this issue has been known by the kernel team and unreported for at least 9 days.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3904
Notice the "Assigned" date, 10/12/2010, that's the date the CVE was created for this flaw and it was likely known and reported several days before that.
What this means is that the kernel team knew of the flaw, it was reported in secret, and they kept it a secret while they researched a fix. So people were vulnerabile for almsot 2 weeks, even though there was a known workaround that would have prevented them from being vulnerable if they had known.
If you need web hosting, you could do worse than here
Sorry for the Anonymous Coward reply, I don't have an account in my name. I'm the researcher who discovered the vulnerability and published it. Just thought I'd clear up a few issues:
1. Stock installations of Ubuntu, Debian, Fedora, Red Hat, Arch, Slackware, and SuSE (and probably more) >= 2.6.30 are (or were) all vulnerable to the issue. Ubuntu has already issued an update, which is why some people can't get the exploit working on their Ubuntu machines. Even if the proof-of-concept doesn't work on your machine, if you have an unpatched machine that compiles RDS as a module, you are vulnerable and should patch.
2. Just because something is "compiled as a module" doesn't mean you have to explicitly have an administrator load it in order for it to be used. Networking protocols can be loaded at runtime by unprivileged users on nearly every distribution, including RDS. This is part of a broader security problem in the Linux world that should be improved.
3. No one should be complaining about the week-long period after reporting before disclosure. The Linux security folks upstream would have published the fix the day I reported the issue, except I specifically requested an embargo period of one week, during which downstream distributions could prepare updates. If I hadn't requested this embargo, then the fix would have been published immediately, but distribution users would have had to wait for their respective distributions to put together updates.
goto fallback;
goto repeat;
See? If gotos are outlawed, only outlaws will have gotos.
Would SELinux not protect against this?
If you ignore ACs because they are anonymous - you're an idiot.
Just tried it on a few of my systems (and a friend's). So I can tell you it works on stock Fedora 14, Fedora 13, Ubuntu 10.10 and Debian sid (kernel 2.6.32). But it did NOT work on Debian 5 (lenny) (kernel 2.6.26).
Consistent with what the article says, but still pretty scary. Again, though, it's a local exploit only.
So there ya go.
- that is my point. Still in Gentoo the percentage doesn't arrive anywhere near 100% because we have genkernel (to generate config and build the kernel automatically).
I like genkernel, place your custom kernel config for the right version in /etc/kernels (just cp any old one), run genkernel --menuconfig for a quick look if there is anything new if you want and done. I use git-sources on my desktop and change kernel frequently and genkernel saves time when (ab)using a _custom_ kernel. And apparently "# CONFIG_RDS is not set"..
9/11: Never forget it was a false-flag operation
Yes, but you can put a newer kernel on it if you really want to, which is why there is the ">= 2.6.30" part in the sentence.
Nine whole days ?
Help stamp out iliturcy.
"The open-source Linux operating system"
LINUX IS A FUCKING KERNEL. The distros comprise the operating system.
Until /. can make this distinction and keep it consistent (and totally disavow any article containing the phrase 'Linux Operating System') this site should not be operating as any sort of distribution site.
It's just as bad as Fox with the spouted nonsense in the actual story.
Sorry, Tako (octopus,) you need to lose your geek-cred license for this site until your brain-dead editors can get their shit right.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
s/cpu cycles/programmer cycles/g
Bugs don't come from lack of CPU cycles, they come from not having infinite time to do testing and code review.
supposedly that was requested by the reporter (although who knows with the ac post :) )
http://linux.slashdot.org/comments.pl?sid=1833084&cid=33978900
Rich
I guess that means most websites then. Nothing to see folks, move along.
Doesn't matter who requested it. It was deliberately kept secret for over a week. This happens *a lot* in open source, and sometimes the time frame is months.
My point is this:
1) Everyone embargoes vulnerabilities, including open source developers. Complaining because closed source vendors do it is the pot calling the kettle black.
2) Too many people believe the myth that bugs in Linux are fixed and distributed "overnight", because few people know that #1 is true.
If you need web hosting, you could do worse than here