Slashdot Mirror
5-Year-Old Critical Linux Vulnerability Patched (threatpost.com)
msm1267 quotes Kaspersky Lab's ThreatPost: A critical, local code-execution vulnerability in the Linux kernel was patched more than a week ago, continuing a run of serious security issues in the operating system, most of which have been hiding in the code for years.
Details on the vulnerability were published Tuesday by researcher Philip Pettersson, who said the vulnerable code was introd in August 2011.
A patch was pushed to the mainline Linux kernel December 2, four days after it was privately disclosed. Pettersson has developed a proof-of-concept exploit specifically for Ubuntu distributions, but told Threatpost his attack could be ported to other distros with some changes. The vulnerability is a race condition that was discovered in the af_packet implementation in the Linux kernel, and Pettersson said that a local attacker could exploit the bug to gain kernel code execution from unprivileged processes. He said the bug cannot be exploited remotely.
"Basically it's a bait-and-switch," the researcher told Threatpost. "The bug allows you to trick the kernel into thinking it is working with one kind of object, while you actually switched it to another kind of object before it could react."
A patch was pushed to the mainline Linux kernel December 2, four days after it was privately disclosed. Pettersson has developed a proof-of-concept exploit specifically for Ubuntu distributions, but told Threatpost his attack could be ported to other distros with some changes. The vulnerability is a race condition that was discovered in the af_packet implementation in the Linux kernel, and Pettersson said that a local attacker could exploit the bug to gain kernel code execution from unprivileged processes. He said the bug cannot be exploited remotely.
"Basically it's a bait-and-switch," the researcher told Threatpost. "The bug allows you to trick the kernel into thinking it is working with one kind of object, while you actually switched it to another kind of object before it could react."
The real story here, is that 4 days after the vulnerability was made known to the devs, a patch was released.
The amazing thing to me is that the linux kernel doesn't even have a testsuite like GCC or binutils (correct me if I'm wrong).
There is a test suite here.
If an attacker is in the same room as your system, you're already pwnd.
... is out of intensive care and is rocking the eye patch.
It little behooves the best of us to comment on the rest of us.
If you want to go this way, maybe gentoo could be considered a test suite, surely not archlinux.
Peoples please stop praising arch for the wrong reasons.
Namely here, arch delivers binaries and this for a quite restricted set of architectures
Even with AUR, you ll get mainly peoples compiling for the same plateformes, with the same options, and mostly compiling apps not the kernel.
Obviously posting as AC, with the number of arch fanboys, this will get downvoted to hell.
In my OS class during my UG CS degree we were writing a small OS. By the time we got to threading we were bitching about how hard it was in *nix so our prof cracked the hood on the Windows threading APIs... We collectively shut the hell up when we saw how hideous and needlessly complicated it was compared to what we were working with.
It turns out that Linux has WAY less bugs than Windows or Mac despite being dreams and wishes...and this is with completely open code base. https://www.cvedetails.com/
Windows is a colostomy bag of code in comparison and it you think you've found a way to improve some part Linux you should write up and submit a patch.
So basically, a classic, well known TOCTTOU vulnerability.
Higher Logics: where programming meets science.
What happened to the "many eyes" argument? Oh yeah that died along with heartbleed and the old SSL codebase.
Only the State obtains its revenue by coercion. - Murray Rothbard
Not everyone who dislikes Linux' design is a MS-shill. Could also be Andrew S. Tanenbaum.
Mac user: Oh yeah? Let me see...
(open Contacts application)
Mac user: You're right, I don't know anyone named Jack.
"He said the bug cannot be exploited remotely."
In other words, "yawn". If you have physical access to a machine all bets are off.
Just cruising through this digital world at 33 1/3 rpm...
From the Shakespeare AU where Othello encounters the Wierd Sisters from Macbeth?
Inheritance is the sincerest form of nepotism.
This bug need CAP_NET_ADMIN privileges, which are VERY rarely enabled for typical user, because they will let you screw network configuration and sniff on traffic (which is almost equal to root privileges in our networking days)
In case anyone cares, this code was first introduced in Linux 3.2.
This is for those of us who use uname -r to check their kernel version, not the year it was checked out from the kernel repos.
"Slow Down Cowboy! It's been 58 minutes since you last successfully posted a comment" -- slashdot, driving users away.
You have no idea what you're talking about. I started with it before it was even released in 1992. It's been very much tested and reviewed. That doesn't mean you catch everything. There are things that happen that you never anticipated. An error occurs. If you can exploit it, you might be able to do something unexpected such as take over the kernel space. If you do, tell them about it and we'll fix it. It's becoming very very hard to break out of that jail.
This is in huge contrast to the Windows kernel. Just a patched up program loader that sucks and is full of holes. I have to manage both and I can tell you that Windows is really full of a LOT of holes. Even for things like group policies they distribute in the clear, even if it has a password in it such as for their laps product. I have to think they don't care about security. Just send a truckload of money to them.
He posts a successful rebuttal to your anonymous MS-shill bullshit
The post which he allegedly rebutted doesn't say anything about Windows. So, no it was not a successful rebuttal.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
So where's the great assertion that open source code is being eyeballed by millions of users so that it's intrinsically better than closed source as all these viewers would spot the error and report it or fix it if this has been in the kernel for many years and as yet unfixed.
I think in reality Open source has many users but very few are capable of reading the code and spotting the errors any more than the equivalent Windows users are, so the whole premise that Open Source code is any better than closed source code is a fallacy!
I think open source has been lucky to date that relatively few malicious hackers have spent time poking around in the code so it was the small numbers of target systems that was keeping the vulnerabilities down not the superiority of the code. I think open source needs to get off its high horse and get some serious security specialists to go through the code and identify the weaknesses and get the code fixed. Open SSL should have been the alarm bell that triggered this.
Siv
Martley, Near Worcester UK.
I think in reality Open source has many users but very few are capable of reading the code and spotting the errors any more than the equivalent Windows users are, so the whole premise that Open Source code is any better than closed source code is a fallacy!
windows has many users, but very few are capable of reading code and spotting errors, too bad they can't fix it. At least on Linux, as few knowledgable people that may be using it, they have that option.
On a long enough timeline, the survival rate for everyone drops to zero.