bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Security leak allows reading Linux kernel memory

Summary

In 2004 Paul Starzetz found several bugs in the Linux kernel’s handling of file offsets through which a logged-in user without special privileges could read kernel memory. The causes were incorrect conversions of 64-bit offsets into 32-bit values and a race condition in the 64-bit file API. In tests, Starzetz found the password of an administrator logged in via SSH in this way.

Ideas

  • Incorrect type conversions between 64 and 32 bits opened read access to kernel memory.
  • Unprotected concurrent access to a variable created a race condition.
  • Kernel memory contains other users’ secrets, such as passwords they have typed.
  • A demo exploit made the hole immediately testable in practice.

Insights

  • On multi-user systems, local holes are just as serious as remote ones.
  • Integer conversion bugs are among the most inconspicuous and dangerous classes of bugs in C.

Facts

  • Kernels 2.4 to 2.4.26 and 2.6 to 2.6.7 were affected.
  • Red Hat already provided fixed kernel packages at publication.

References

Critique

  • The report names no workarounds for systems that cannot be rebooted immediately.

Recommendations

  • Apply kernel updates particularly quickly on multi-user systems and shell servers.
  • Restrict interactive logins on servers to the users who really need them.

Read the original article

Search the Web Archive

hß · 2018

Linux: kernel and distributions protect against the Foreshadow/L1TF processor flaw

In August 2018 the processor flaw Foreshadow, also known as L1 Terminal Fault (L1TF), became known in many Intel CPUs; the Linux main branch and major distributions immediately provided protection. Anyone running third-party virtual machines also had to switch off hyper-threading, which could cost VMs up to 50 percent of their performance. The stable and longterm kernels appeared after less than 24 hours of review.

hß · 2017

Linux 4.13: kernel handles TLS encryption itself

In 2017 Linux 4.13 was able to take over the encryption and decryption of a TLS connection itself for the first time. This was meant to improve performance and open up new uses. The complex connection setup, however, is still handled by libraries such as OpenSSL in user space.

hß · 2010

Root privileges through Linux kernel bug [Update]

In 2010 Rafal Wojtczuk described a problem in Linux memory management in which the stack and shared memory segments could grow into each other. Using the X server as an example, Wojtczuk showed how an attacker could overwrite return addresses on the stack by writing to the shared memory and gain root privileges. The fix, a guard page between the stack and other areas, came in 2.6.32.19, 2.6.34.4 and 2.6.35.2, although SUSE had offered a fix as early as 2004.