Slashdot Mirror
Exploits Emerge For Linux Privilege Escalation Flaw
angry tapir writes "Linux vendors are rushing to patch a privilege escalation vulnerability in the Linux kernel that can be exploited by local attackers to gain root access on the system. The vulnerability, which is identified as CVE-2012-0056, was discovered by Jüri Aedla and is caused by a failure of the Linux kernel to properly restrict access to the '/proc//mem' file."
Awesome that this will lead to easier root access on Android devices.
On the flip side I'm sure Android vendors won't get around to patching this for a while and our devices will be vulnerable.
Now, off to patch my Linux boxen.
"Frequently wrong, never in doubt."
If someone is in a position to run a local exploit, aren't you pretty much fucked anyways?
It'll be fixed tomorrow
"I disapprove of what you say, but I will defend to the death your right to say it." - Evelyn Beatrice Hall, re Voltaire
so someone has to be sitting in front of the boxen to exploit the exploit, why not just init 1? Serious question :)
http://chimpbox.us
It's official: iOS now has more marketshare than Android. Reuters reports that Apple completely erased Android's marketshare lead, confirming earlier reports by both Nielsen and NPD. Over 150 Android smartphones couldn't outcompete the iPhone 4S. With 37 million iPhones sold last quarter, Apple is the largest smartphone marker, and their profits exceed Google’s entire revenue, $13 billion to $10.6 billion. Finally, with 15 million iPads sold last quarter, the tablet market is now larger than the entire desktop PC market.
The clock is ticking, Fandroids.
Funny that you mention the f word, after the expected RETURN of Apples marketshare lead has been comented as a "complete erase". Note: Apples marketshare accoring to the quoted market researchers is 44.9 versus googles 44.8. Wow. Beaten into the ground eh? And then.. 10.6 isnt Googles entire revenue. It s their profit. http://investor.google.com/financial/tables.html With all that said. Even if Apple had a marketshare of 70 or 80 percent or more on smartphones (NOT:all mobile phones): thats totally not a reason to buy their product. It would be a reason to worry bout market domination though. But besides that, for many people there are other more valid reason to decide for another phone.
Start programming, Linus!
http://blog.zx2c4.com/749
Gets into the memory specifics of the bug. I found it to be far better than the actual article.
And we killed 8 goto's along the way. ;)
Nice work folks.
Pardon me, but I'm going to go watch Firefly now, as it appears none of you make any sense. Bye.
"Tongue tied and twisted, just an Earth bound misfit
Since this bug was introduced in Linux 2.6.39 Debian Stable (squeeze, Linux 2.6.32) is not affected. Unstable(sid, Linux 3.1) has already been patched, though Testing (wheezy) is still vulnerable.
More information here
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Just so everybody knows, I'm not involved with the stupid troll/countertroll argument!
Although I should have made the number -1337.
And yet you still failed.
Go to bed, bonch.
There is /proc/pid/mem, a pseudofile referring to the memory of process pid. It has 0600 permissions so you can't write to the memory of other users' processes. The bug occurs when you exec an suid executable and the kernel does not change open fds for /proc/pid/mem. This way, you can open mem, dup it to stderr, and exec su with a garbage parameter. su will duly print an error, quoting the offending parameter, writing to its process memory. With a properly selected shellcode you can get root.
Believe it or not there are still machines where you can get a shell account, and
hence try a local exploit. Plus exploits kind of multiply their power. Remote
unprivileged execution + local root exploit = remote root exploit.
Remember local access isn't the same as physical access (in which case without
special hardware locks you ARE f**ked.).
My first thought is that this is a perfect example of why Linux fanbois should pay more attention to the speck of dust in their eye than the logs stuck in Windows' and OSX's eyes.
Err, at least I think that's how the saying goes.
--Jeremy
Jesus was a liberal
It only seems that way to the miserably uninformed. Relax. Smoke something.
You either don't know what the word all means, or you don't know what the term security through obscurity means.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Again, you don't know what security through obscurity means. If the access to the code or other design that implements the security breaks it, then that is security through obscurity. All security relies on a secret known by one party, but unknown to others. This has absolutely nothing to do with security by obscurity.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
>Pardon me, but I'm going to go watch Firefly now, as it appears none of you make any sense. Bye.
But.. but... how can you watch Firefly when Nielsen and NPD confirm that people buy cellphones? :O
I need a new wristwatch... one with a stockmarket ticker... so I know with which mp3 player i"ll father my next child..
Have you vetted your x86 CPU vendor's microcode for correctness? How far down do the proverbial turtles go?
I think present_arms's point is that local console access involves access to the big red switch and the bootloader, which on a PC-type system can be used to gain root by booting into single-user mode.
Some of them rhyme with VAXen though.
LOL indeed! Last I remember of NT was a very cantankerous beast that wouldn't fucking run anything correctly but ecosystem programs.
"Windows NT is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. It was a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix "
http://en.wikipedia.org/wiki/Windows_NT
Try a bigger worm on the hook, please...;-)
/dev/kmem and 4.2 BSD spy program batman!
Windows isn't affected by this attack. That shows how secure an OS made by professionals is. When you go with the Linux, one made by fly by night amateurs, you will get hacked.
is the very wrong quotation!
The original source quotes instead:
which is the memory as seen by a certain process whose PID is <pid>.
Moreover, there's no "/proc/mem" file and the "//" whould be interpreted as "/".
But maybe that'd be just the Slashdot editor.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
You seem to be in a situation where PEBKAC - it's corrupting the text of your post. Of course what you meant to say is that the Open Source model does not guarantee security but simply allows interested parties to audit for and fix security problems independent of any single company or other rights holding restricting access to the source. Generally we find that the Open Source model has worked well for Linux and has been effective at addressing security concerns. The question is sometimes not whether problems exist, but whether or not they are found and corrected.
Speaking of security on Windows - if that post of yours isn't a case where PEBKAC, you might want to install some anti virus software - looks like someone might have pwnd your machine.
I have a certificate signed by the PRC themselves, though I am struggling a bit with the Mandarin.
Yes, but that doesn't automatically mean anyone saying something that a "shill" might possibly say is actually a "shill". That's how bat-brained conspiracy theories start.
This is a relatively mild exploit that has been effectively squashed. Why all the hoopla over nothing ? One should be more concerned with Microsoft and the trucKload of exploits that have yet to be addressed with Vista. Windows 7 and IE.
Well can we all agree now that an unpatched OS, no matter if its OSX, BSD, Windows OR Linux, is a bad thing? Because i am really tired of posting how much trouble i'm having with updates puking on drivers only to get told "Well just disable updates and the sell the machine! Nothing will go wrong, its Linux!". There is NO "magical OS" that is immune to exploits, none. In the past couple of years we've seen Windows, Linux, Android, iOS, every OS of any popularity at all has been pwned at least once, most several times.
so can we please put the lie to bed that you can run unpatched Linux systems and never have to worry, please? Oh and for those that say "nobody would say that" i got that same answer not an hour ago so this belief is apparently common, scarily enough.
ACs don't waste your time replying, your posts are never seen by me.
Your article references the U.S. only. You do know there is more countries than just the U.S, right?
Change is certain; progress is not obligatory.
After all the Windows bashing that happens on Slashdot, haven't seen a single post going "HAAAA!!! Run linux kiddies, run and patch that server!"
But now you have :)
Run...
You do know there is more countries than just the U.S, right?
You're not suggesting those other countries actually matter, are you? What century are you living in? :-)
"Tongue tied and twisted, just an Earth bound misfit
You spread it on like peanut butter & sand the hell out of it.
Your actual link does have 10.6 as ... Google's entire Q4 revenue. Top right corner of the graph, $10,584. So, yeah, last quarter Apple's quarterly profit was 125% of Google's entire quarterly revenue. Scroll down and see that Google's Q4 net income was $2.7B. Or, in other words, one fifth of Apple's.
tldr; your link contradicts your claim and reinforces the GP poster.
What programs depend on it to be writeable? Just make the file read-only for the PID owner.
Not the century one that forgets where the majority of the world's population or where the strongest currency is.
Change is certain; progress is not obligatory.
You're not suggesting those other countries actually matter, are you? What century are you living in? :-)
Not the century one that forgets where the majority of the world's population or where the strongest currency is.
China? Really? The country with the most worthless people (per capita)? Doin' the math, ... One country / 7 billion people ...
Do any individual Chinese citizens amount to anything worth your consideration, or do you just throw them into the meat grinder as usual AS CHINA HAS FOR THE PAST FOUR THOUSAND YEARS? To the PRC, I'm wondering. Sorry, venting, I may have issues.
BTW, I do have Chinese friends. Some of them are fairly special to me.
Damn, I'm looking forward to seeing you asshats in the crosshairs of my sniper rifle. Now why does "People's Republic of China" make me giggle so hard?
Oh yeah. Mao Tse Tung!
You know where to find me, and the sooner the better.
"Tongue tied and twisted, just an Earth bound misfit
Your assumptions amuse me, mistakening me for Chinese.
Change is certain; progress is not obligatory.
Pardon me, but I'm going to go watch Firefly now, as it appears none of you make any sense. Bye.
But.. but... how can you watch Firefly when Nielsen and NPD confirm that people buy cellphones? :O
This NPD? "NPD is a large polling company that that helps other companies report information about public. occationally they mess up really bad"
Wow. There is one hole hell of a lot of "FAIL" in there.
I need a new wristwatch... one with a stockmarket ticker... so I know with which mp3 player i"ll father my next child..
I believe you just proved my original point.
I think I'll go look for willing clitorises to pleasure now, toodles. [I believe the world would be a much better place were my tounge pleasuring more clitorises (but that's just my opinion).]
"Tongue tied and twisted, just an Earth bound misfit
Your assumptions amuse me, mistakening me for Chinese.
Yeah, I've got to admit, that looked pretty strange to me too this morning. I'll go find a wall to bang my head on now.
"Tongue tied and twisted, just an Earth bound misfit
where's your 'apk' sig you fucking troll
12: to conceal
Concealing your password (as opposed to sticking it on a post-it or in your signature) is very much "security through obscurity."
That you can't understand that all security ultimately is based on something concealed is sad - it means you'll believe that things like biometrics are secure, when they're not (and they're also very much based on hiding something, both at the design and implementation levels, as well as the user level. If I have the information needed to duplicate your fingerprint, or the information on the data stream between the fingerprint reader and the rest of the system as well as the information on how to insert data into that stream, and the datastream that would result from your fingerprint, your data is mine).
There is no such thing as something that is 100% secure, but every bit of hiding (obscuring) information helps.
Let's call it what it is, Anti-Social Media.