Slashdot Mirror
Exploits Emerge For Linux Privilege Escalation Flaw
angry tapir writes "Linux vendors are rushing to patch a privilege escalation vulnerability in the Linux kernel that can be exploited by local attackers to gain root access on the system. The vulnerability, which is identified as CVE-2012-0056, was discovered by Jüri Aedla and is caused by a failure of the Linux kernel to properly restrict access to the '/proc//mem' file."
What do you mean it was already at -3000?
this truly has been a special mom
It's official: iOS now has more marketshare than Android. Reuters reports that Apple completely erased Android's marketshare lead, confirming earlier reports by both Nielsen and NPD. Over 150 Android smartphones couldn't outcompete the iPhone 4S. With 37 million iPhones sold last quarter, Apple is the largest smartphone marker, and their profits exceed Google’s entire revenue, $13 billion to $10.6 billion. Finally, with 15 million iPads sold last quarter, the tablet market is now larger than the entire desktop PC market.
The clock is ticking, Fandroids.
All us Linucks fanboys know that windoze is insecure and Lincks is not.
Open Sores makes everything more secure. It's like nobody wants to go near open sores.
This must be a vulnerability in Windoze or user error. Linucks is perfect thanks to open sores.
Awesome that this will lead to easier root access on Android devices.
On the flip side I'm sure Android vendors won't get around to patching this for a while and our devices will be vulnerable.
Now, off to patch my Linux boxen.
"Frequently wrong, never in doubt."
If someone is in a position to run a local exploit, aren't you pretty much fucked anyways?
GreatBunzinni has been posting anonymous accusations listing a whole bunch of Slashdot accounts as being part of a marketing campaign for Microsoft, without any evidence. GreatBunzinni has accidentally outed himself as this anonymous poster. Half the accounts he attacks don't even post pro-Microsoft rhetoric. The one thing they appear to have in common is that they have been critical of Google in the past. GreatBunzinni has been using multiple accounts to post these "shill" accusations, such as Galestar, NicknameOne, and flurp.
That's not the problem. The problem is that moderators gave him +5 Informative and are now modding down the accused, even for legitimate posts. Metamoderation is supposed to address this by filtering out the bad moderators, but clearly it's not working.
This "shill" crap that has been flying around lately has to stop. It's restricting a variety of viewpoints from participating on the site and creating an echo chamber.
It'll be fixed tomorrow
"I disapprove of what you say, but I will defend to the death your right to say it." - Evelyn Beatrice Hall, re Voltaire
so someone has to be sitting in front of the boxen to exploit the exploit, why not just init 1? Serious question :)
http://chimpbox.us
Start programming, Linus!
http://blog.zx2c4.com/749
Gets into the memory specifics of the bug. I found it to be far better than the actual article.
And we killed 8 goto's along the way. ;)
Nice work folks.
I just had an eidetic flashback to something I fled an hour ago.
From On The Evolution Of Ashkenazi Jewish Intelligence
Welcome to racially slanted IQ, goldbug, futurology hell. Your application shows merit, but fails to display elite OCD stamina. Please try again when your vigour suffices.
Since this bug was introduced in Linux 2.6.39 Debian Stable (squeeze, Linux 2.6.32) is not affected. Unstable(sid, Linux 3.1) has already been patched, though Testing (wheezy) is still vulnerable.
More information here
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Seriously, WHAT THE FUCK?
What absolutely fucking stupid moron came up with this idea? This is beyond retarded and the reason why Linux' code is nothing but a spaghetti mess - no design, no forthought, just code away like in good old BASIC times.
Go to bed, bonch.
There is /proc/pid/mem, a pseudofile referring to the memory of process pid. It has 0600 permissions so you can't write to the memory of other users' processes. The bug occurs when you exec an suid executable and the kernel does not change open fds for /proc/pid/mem. This way, you can open mem, dup it to stderr, and exec su with a garbage parameter. su will duly print an error, quoting the offending parameter, writing to its process memory. With a properly selected shellcode you can get root.
Yes.. thats how much UNIX design sucks and lags behind NT. While NT has always had superior fine-grained process security descriptors.. the UNIX shitty design had to create more bolted-on shit into an even more shitty monolithic kernel with spaghetti dependencies and no clear kernel ABI.
UAC has nothing to do with sudo or apparmour (also GP is a moron for even bringing it up). All those things have been present in NT for about 20 years since the first version came out. Its embarrassing that the NSA had to come out and say.. dude your OS kinda sucks and create a new security layer for it (which is still broken) just to bring it on par with NT.
Believe it or not there are still machines where you can get a shell account, and
hence try a local exploit. Plus exploits kind of multiply their power. Remote
unprivileged execution + local root exploit = remote root exploit.
Remember local access isn't the same as physical access (in which case without
special hardware locks you ARE f**ked.).
My first thought is that this is a perfect example of why Linux fanbois should pay more attention to the speck of dust in their eye than the logs stuck in Windows' and OSX's eyes.
Err, at least I think that's how the saying goes.
--Jeremy
Jesus was a liberal
It only seems that way to the miserably uninformed. Relax. Smoke something.
You either don't know what the word all means, or you don't know what the term security through obscurity means.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Again, you don't know what security through obscurity means. If the access to the code or other design that implements the security breaks it, then that is security through obscurity. All security relies on a secret known by one party, but unknown to others. This has absolutely nothing to do with security by obscurity.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Have you vetted your x86 CPU vendor's microcode for correctness? How far down do the proverbial turtles go?
I think present_arms's point is that local console access involves access to the big red switch and the bootloader, which on a PC-type system can be used to gain root by booting into single-user mode.
Some of them rhyme with VAXen though.
/dev/kmem and 4.2 BSD spy program batman!
Windows isn't affected by this attack. That shows how secure an OS made by professionals is. When you go with the Linux, one made by fly by night amateurs, you will get hacked.
is the very wrong quotation!
The original source quotes instead:
which is the memory as seen by a certain process whose PID is <pid>.
Moreover, there's no "/proc/mem" file and the "//" whould be interpreted as "/".
But maybe that'd be just the Slashdot editor.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
I have a certificate signed by the PRC themselves, though I am struggling a bit with the Mandarin.
This is a relatively mild exploit that has been effectively squashed. Why all the hoopla over nothing ? One should be more concerned with Microsoft and the trucKload of exploits that have yet to be addressed with Vista. Windows 7 and IE.
After all the Windows bashing that happens on Slashdot, haven't seen a single post going "HAAAA!!! Run linux kiddies, run and patch that server!"
But now you have :)
Run...
You spread it on like peanut butter & sand the hell out of it.
What programs depend on it to be writeable? Just make the file read-only for the PID owner.
12: to conceal
Concealing your password (as opposed to sticking it on a post-it or in your signature) is very much "security through obscurity."
That you can't understand that all security ultimately is based on something concealed is sad - it means you'll believe that things like biometrics are secure, when they're not (and they're also very much based on hiding something, both at the design and implementation levels, as well as the user level. If I have the information needed to duplicate your fingerprint, or the information on the data stream between the fingerprint reader and the rest of the system as well as the information on how to insert data into that stream, and the datastream that would result from your fingerprint, your data is mine).
There is no such thing as something that is 100% secure, but every bit of hiding (obscuring) information helps.
Let's call it what it is, Anti-Social Media.