Exploits Emerge For Linux Privilege Escalation Flaw

← Back to Stories (view on slashdot.org)

Exploits Emerge For Linux Privilege Escalation Flaw

Posted by samzenpus on Wednesday January 25, 2012 @10:46AM from the protect-ya-neck dept.

angry tapir writes "Linux vendors are rushing to patch a privilege escalation vulnerability in the Linux kernel that can be exploited by local attackers to gain root access on the system. The vulnerability, which is identified as CVE-2012-0056, was discovered by Jüri Aedla and is caused by a failure of the Linux kernel to properly restrict access to the '/proc//mem' file."

5 of 176 comments (clear)

Min score:

Reason:

Sort:

Re:Local exploit? by Lumpio- · 2012-01-25 11:12 · Score: 5, Informative

A weak SSH user account/PHP script/whatever + local privilege escalation = instant remote root
Link to more info by milbournosphere · 2012-01-25 11:15 · Score: 5, Informative

It's a geekier breakdown, but is quite informative.
http://blog.zx2c4.com/749
Gets into the memory specifics of the bug. I found it to be far better than the actual article.
Re:Hrrm by Anonymous Coward · 2012-01-25 11:41 · Score: 5, Informative

I was with you up until Rule #3 which is nonsense.
Debian (mostly) not affected by Trogre · 2012-01-25 11:43 · Score: 5, Informative

Since this bug was introduced in Linux 2.6.39 Debian Stable (squeeze, Linux 2.6.32) is not affected. Unstable(sid, Linux 3.1) has already been patched, though Testing (wheezy) is still vulnerable.
More information here

--
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Simple explanation by Chemisor · 2012-01-25 12:49 · Score: 5, Informative

There is /proc/pid/mem, a pseudofile referring to the memory of process pid. It has 0600 permissions so you can't write to the memory of other users' processes. The bug occurs when you exec an suid executable and the kernel does not change open fds for /proc/pid/mem. This way, you can open mem, dup it to stderr, and exec su with a garbage parameter. su will duly print an error, quoting the offending parameter, writing to its process memory. With a properly selected shellcode you can get root.