Slashdot Mirror

← Back to Stories (view on slashdot.org)

5-Year-Old Linux Kernel Bug Fixed

Posted by Soulskill on from the must-have-been-union dept.

rastos1 sends in a report about a significant bug fix for the Linux kernel (CVE-2014-0196). "'The memory-corruption vulnerability, which was introduced in version 2.6.31-rc3, released no later than 2009, allows unprivileged users to crash or execute malicious code on vulnerable systems, according to the notes accompanying proof-of-concept code available here. The flaw resides in the n_tty_write function controlling the Linux pseudo tty device. 'This is the first serious privilege escalation vulnerability since the perf_events issue (CVE-2013-2049) in April 2013 that is potentially reliably exploitable, is not architecture or configuration dependent, and affects a wide range of Linux kernels (since 2.6.31),' Dan Rosenberg, a senior security researcher at Azimuth Security, told Ars in an e-mail. 'A bug this serious only comes out once every couple years.' ... While the vulnerability can be exploited only by someone with an existing account, the requirement may not be hard to satisfy in hosting facilities that provide shared servers, Rosenberg said."

3 of 127 comments (clear)

  1. Re:This is the problem with Linux Security by Anonymous Coward · · Score: 5, Interesting

    Well it can't be patched before it was discovered but you seem to be implying this issue was known about 5 years ago.

    How long from when it was discovered did it take to be patched?

  2. Re:This is the problem with Linux Security by Anonymous Coward · · Score: 5, Funny

    You know, Linux Torvaldx ix the guy who firxt xtarted writing the Linux kernel. He'x pretty famoux. I'm xurprixed you've never heard of him.

  3. POC doesn't work here. by ralphtheraccoon · · Score: 5, Interesting

    I read through the POC, it seemed safe enough to play with, so I've tried it out on a few different servers here (CentOS & Debian Stable). On the CentOS boxes it dies before it even gets started trying to overflow into a tty, and on my Debian machine it's been going for 5 minutes (using up to 90% CPU, but still leaving the machine quite usable), and still hasn't got anywhere.

    This isn't quite the "instant ROOT ACCESS!" privilege escalation that scares keeps sysadmins up at night. (unless I'm missing something...)