Slashdot Mirror
RDS Protocol Bug Creates a Linux Kernel Hole, Now Fixed
Trailrunner7 writes "The open-source Linux operating system contains a serious security flaw that can be exploited to gain superuser rights on a target system. The vulnerability, in the Linux implementation of the Reliable Datagram Sockets (RDS) protocol, affects unpatched versions of the Linux kernel, starting from 2.6.30, where the RDS protocol was first included." The article goes on to say, though, that "Linux installations are only vulnerable if the CONFIG_RDS kernel configuration option is set, and if there are no restrictions on unprivileged users loading packet family modules, as is the case on most stock distributions," and that Linus Torvalds has committed a fix.
They should mention in the summary this is a local privilege escalation exploit only.
Reliable Datagram Sockets (RDS) provide in order, non-duplicating, highly available, low overhead, reliable delivery of datagrams between hundreds of thousands of non-connected endpoints."
/etc/modprobe.d/disable-rds
Gives new meaning...
Recommendation:
Users should install updates provided by downstream distributions or apply the committed patch [3] and recompile their kernel.
Preventing the RDS kernel module from loading is an effective workaround. This can be accomplished by executing the following command as root:
echo "alias net-pf-21 off" >
He who knows best knows how little he knows. - Thomas Jefferson
An explanation of what the exploit is, is not excuse.
All modern OS have these problems, the reality is we get speed or security and everyone has chosen speed. Maybe in 40 more years we will have the cpu cycles to waste.
If you release early and you release often, you will release a big piece of sh^H^H code with a lot of bugs.
Funny how Microsoft releases late and releases seldom and has the same problem...
"Maybe this world is another planet's hell"
Aldous Huxley
2.2.26 is still working great for me, thanks!
If only there were some way for him to control what goes in the kernel.
Give me Classic Slashdot or give me death!
Nope. The usual Microsoft nonsense is still alive and well in 2010.
A Pirate and a Puritan look the same on a balance sheet.
The same article announcing the existence of the exploit announced the existence of the fix. That's pretty good support if you ask me, and it's hard to be too worried under those circumstances.
Yeah, it's 2010, and every Tuesday my computer bitches about how I have updates waiting to be installed...
:(){
Was this vulnerability fixed in yesterday's massive security update?
``Tension, apprehension & dissension have begun!'' - Duffy Wyg&, in Alfred Bester's _The Demolished Man_
Of course what you don't know is that this issue has been known by the kernel team and unreported for at least 9 days.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3904
Notice the "Assigned" date, 10/12/2010, that's the date the CVE was created for this flaw and it was likely known and reported several days before that.
What this means is that the kernel team knew of the flaw, it was reported in secret, and they kept it a secret while they researched a fix. So people were vulnerabile for almsot 2 weeks, even though there was a known workaround that would have prevented them from being vulnerable if they had known.
If you need web hosting, you could do worse than here
If by "immediately fixed" you mean nearly two weeks being kept secret by the kernel team while they worked on it, and you were vulnerable.. and if by "distributed overnight" you mean probably several more days before the various distros make it availble...
This bug was reported to the kernel team on 10/12, not yesterday.
If you need web hosting, you could do worse than here
Sorry for the Anonymous Coward reply, I don't have an account in my name. I'm the researcher who discovered the vulnerability and published it. Just thought I'd clear up a few issues:
1. Stock installations of Ubuntu, Debian, Fedora, Red Hat, Arch, Slackware, and SuSE (and probably more) >= 2.6.30 are (or were) all vulnerable to the issue. Ubuntu has already issued an update, which is why some people can't get the exploit working on their Ubuntu machines. Even if the proof-of-concept doesn't work on your machine, if you have an unpatched machine that compiles RDS as a module, you are vulnerable and should patch.
2. Just because something is "compiled as a module" doesn't mean you have to explicitly have an administrator load it in order for it to be used. Networking protocols can be loaded at runtime by unprivileged users on nearly every distribution, including RDS. This is part of a broader security problem in the Linux world that should be improved.
3. No one should be complaining about the week-long period after reporting before disclosure. The Linux security folks upstream would have published the fix the day I reported the issue, except I specifically requested an embargo period of one week, during which downstream distributions could prepare updates. If I hadn't requested this embargo, then the fix would have been published immediately, but distribution users would have had to wait for their respective distributions to put together updates.
goto fallback;
goto repeat;
See? If gotos are outlawed, only outlaws will have gotos.
Would SELinux not protect against this?
If you ignore ACs because they are anonymous - you're an idiot.
- that is my point. Still in Gentoo the percentage doesn't arrive anywhere near 100% because we have genkernel (to generate config and build the kernel automatically).
I like genkernel, place your custom kernel config for the right version in /etc/kernels (just cp any old one), run genkernel --menuconfig for a quick look if there is anything new if you want and done. I use git-sources on my desktop and change kernel frequently and genkernel saves time when (ab)using a _custom_ kernel. And apparently "# CONFIG_RDS is not set"..
9/11: Never forget it was a false-flag operation
Yes, but you can put a newer kernel on it if you really want to, which is why there is the ">= 2.6.30" part in the sentence.
Perhaps he should write his own version control system.
http://michaelsmith.id.au
Oh c'mon! Quit trying to build straw men here! This is NOT about the policies of Apple or MSFT, this is about why they didn't issue the simple workaround instead of sitting on it for TWO WEEKS while leaving users vulnerable! If you think MSFT had pulled the same thing people wouldn't be roasting their nuts here? so why does Linus get better treatment? If you want to compare to MSFT, fine. MSFT often issues workaround for bugs they haven't gotten fixed yet. Considering if the above poster is correct we are talking about a single line that needed to be input would it REALLY have put them out to say "Hey, there is a problem, we're on it. Until we push out the patch run this. Thanks", I mean really? when we are talking about the #1 most popular Linux distro having a hole in the default config I really don't think it is too much to ask for them to issue the workaround. Do you?
ACs don't waste your time replying, your posts are never seen by me.
Nine whole days ?
Help stamp out iliturcy.
And meanwhile, since practically nobody and nothing actually uses that protocol, just disabe it unless/until you apply the update.
Saying as such would let criminals know the issue exists before the CVE was even posted. You might as well have just said "hey everyone, there's a security exploit here that we haven't figured out how to fix". What is the point except for giving criminals an extra week to come up with a working exploit.
"The open-source Linux operating system"
LINUX IS A FUCKING KERNEL. The distros comprise the operating system.
Until /. can make this distinction and keep it consistent (and totally disavow any article containing the phrase 'Linux Operating System') this site should not be operating as any sort of distribution site.
It's just as bad as Fox with the spouted nonsense in the actual story.
Sorry, Tako (octopus,) you need to lose your geek-cred license for this site until your brain-dead editors can get their shit right.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
supposedly that was requested by the reporter (although who knows with the ac post :) )
http://linux.slashdot.org/comments.pl?sid=1833084&cid=33978900
Rich
I guess that means most websites then. Nothing to see folks, move along.
Doesn't matter who requested it. It was deliberately kept secret for over a week. This happens *a lot* in open source, and sometimes the time frame is months.
My point is this:
1) Everyone embargoes vulnerabilities, including open source developers. Complaining because closed source vendors do it is the pot calling the kettle black.
2) Too many people believe the myth that bugs in Linux are fixed and distributed "overnight", because few people know that #1 is true.
If you need web hosting, you could do worse than here
Yes, that would have been great, had people known about the vulnerability when it was discovered. Instead, it was kept secret for nearly 2 weeks.
If you need web hosting, you could do worse than here