Exploits Emerge For Linux Privilege Escalation Flaw

angry tapir writes "Linux vendors are rushing to patch a privilege escalation vulnerability in the Linux kernel that can be exploited by local attackers to gain root access on the system. The vulnerability, which is identified as CVE-2012-0056, was discovered by Jüri Aedla and is caused by a failure of the Linux kernel to properly restrict access to the '/proc//mem' file."

Comments

Hrrm

[Anonymous Coward]

If someone is in a position to run a local exploit, aren't you pretty much fucked anyways?

Re:Hrrm

[MichaelSmith]

Web servers are vulnerable because they run server side code, often uploaded with vulnerable content management systems, etc.

Re:Hrrm

[Anonymous Coward]

I was with you up until Rule #3 which is nonsense.

Re:Hrrm

[Mad Merlin]

Rule #1: There is no such thing as 100% secure. Even 100% bug-free cannot be considered 100% secure.

There's also no such thing as 100% bug-free.

Rule #3: All security is ultimately "security through obscurity."

While in the strictest sense, this may not be untrue, to phrase it that way is extremely dishonest. An encryption algorithm that relies on the secrecy of the algorithm is totally worthless (security by obscurity), whereas an encryption algorithm that relies on the secrecy of the keys used for encryption is quite useful (not security by obscurity in the normal sense).

In fact, if you want to be pedantic about it, the relevant definition for obscure is...

not readily understood or clearly expressed; also : mysterious [1]

Which is about understanding and not so much about knowledge. I may understand that I need a username and password to log into your system, just because I don't know what the username or password is doesn't make it security by obscurity. In fact, say I wanted to break into your house, I may have seen you use a physical key to open the front door and walk in and I may have even memorized the pattern of teeth on the key, but it does me no good if I don't have a key of my own to open the door with. There is certainly no obscurity in that security.

If you're going to go ahead and say that all security is "security through obscurity", then you may as well make the next logical step of not implementing any of it.

[1] http://www.merriam-webster.com/dictionary/obscure

Re:Local exploit?

[Lumpio-]

A weak SSH user account/PHP script/whatever + local privilege escalation = instant remote root

Link to more info

[milbournosphere]

It's a geekier breakdown, but is quite informative.

http://blog.zx2c4.com/749

Gets into the memory specifics of the bug. I found it to be far better than the actual article.

Re:iOS now has more marketshare than Android

[tqk]

Pardon me, but I'm going to go watch Firefly now, as it appears none of you make any sense. Bye.

Debian (mostly) not affected

[Trogre]

Since this bug was introduced in Linux 2.6.39 Debian Stable (squeeze, Linux 2.6.32) is not affected. Unstable(sid, Linux 3.1) has already been patched, though Testing (wheezy) is still vulnerable.

More information here

Re:Broken on Android too

[Abreu]

Wuh, I think so, Brain, but if we didn't have ears, we'd look like weasels

Re:Local exploit?

[BasilBrush]

so someone has to be sitting in front of the boxen to exploit the exploit, why not just init 1?

Or they could use axen to destroy the boxen. Or set some foxen on them to tear them to pieces. Or they could fill the boxen with melted waxen. Or bury them in faxen. This exploit is usable by people of both sexen, so long as they pay their taxen.

Simple explanation

[Chemisor]

There is /proc/pid/mem, a pseudofile referring to the memory of process pid. It has 0600 permissions so you can't write to the memory of other users' processes. The bug occurs when you exec an suid executable and the kernel does not change open fds for /proc/pid/mem. This way, you can open mem, dup it to stderr, and exec su with a garbage parameter. su will duly print an error, quoting the offending parameter, writing to its process memory. With a properly selected shellcode you can get root.

Beware of ALL blanket statements ;-)

[Zero__Kelvin]

All security is ultimately "security through obscurity."

"I was with you up until Rule #3 which is nonsense."

Really? Try proving it's "nonsense". .

You either don't know what the word all means, or you don't know what the term security through obscurity means.

Proof you are 100% wrong per your request

[Zero__Kelvin]

Again, you don't know what security through obscurity means. If the access to the code or other design that implements the security breaks it, then that is security through obscurity. All security relies on a secret known by one party, but unknown to others. This has absolutely nothing to do with security by obscurity.

Re:Proof you are 100% wrong per your request

[Zero__Kelvin]

Do you have a problem reading and understanding the English language? While I appreciate your attempts to credit the definition as my own, it has been an accepted term in security circles for a long time, and I am not the one who came up with it. Nobody worth their salt ever said that 100% security can be achieved, and you are not saying anything that isn't obvious to even a security neophyte like yourself. What is known is that security through obscurity is not an effective method of achieving security, even in deference to the fact that nobody will ever achieve 100% security.

Re:Broken on Android too

[NeoMorphy]

Really? This bug was only present in kernel releases 2.6.39 and newer. Do any Android devices use kernel's based on a Linux this current? A quick search says Android 2.3. used 2.6.35 and 3.0 used 2.6.36 so the number of devices this might possibly help you root looks miniscule.

I am replying with my new Asus Transformer Prime, which is running ICS(Android version 4.03), kernel is 2.6.39.4.

I'm thinking this bug is God's way of saying "You are loved. Now go forth and exploit your tablet!"

What'd "//" be ?

[aglider]

/proc//mem

is the very wrong quotation!
The original source quotes instead:

/proc/<pid>/mem

which is the memory as seen by a certain process whose PID is <pid>.
Moreover, there's no "/proc/mem" file and the "//" whould be interpreted as "/".
But maybe that'd be just the Slashdot editor.

Re:Better than Windoze

[Tim4444]

You seem to be in a situation where PEBKAC - it's corrupting the text of your post. Of course what you meant to say is that the Open Source model does not guarantee security but simply allows interested parties to audit for and fix security problems independent of any single company or other rights holding restricting access to the source. Generally we find that the Open Source model has worked well for Linux and has been effective at addressing security concerns. The question is sometimes not whether problems exist, but whether or not they are found and corrected.

Speaking of security on Windows - if that post of yours isn't a case where PEBKAC, you might want to install some anti virus software - looks like someone might have pwnd your machine.