bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Fixes for security hole in the Linux kernel [second update]

Summary

In August 2009 kernels 2.6.27.30 and 2.6.30.5 appeared, closing a hole that had existed since 2001 through which normal users could gain root privileges. Debian and Fedora delivered updates immediately and Ubuntu followed a day later, while Red Hat and SUSE initially only offered workarounds. Red Hat recommended disabling the affected network protocols, which rendered the public exploit ineffective.

Ideas

  • Distributions react to the same kernel hole at different speeds.
  • Disabling unused protocols can defuse an exploit until the patch arrives.
  • Derived distributions such as CentOS depend on the original’s patch.

Insights

  • The choice of distribution determines how long a system remains unprotected after a hole becomes known.
  • Good workarounds are a contribution to security in their own right, not just a stopgap.

Facts

  • The hole was fixed in 2.6.27.30 and 2.6.30.5.
  • Ubuntu delivered fixes for 6.06 LTS, 8.04 LTS, 8.10 and 9.04.

References

Critique

  • The report does not name the protocols that could be disabled, so readers cannot implement the workaround directly.

Recommendations

  • Permanently block the loading of unused protocol modules via the modprobe configuration.
  • With derived distributions, watch when the original delivers a patch.

Read the original article

Search the Web Archive

hß · 2010

Root privileges through Linux kernel bug [Update]

In 2010 Rafal Wojtczuk described a problem in Linux memory management in which the stack and shared memory segments could grow into each other. Using the X server as an example, Wojtczuk showed how an attacker could overwrite return addresses on the stack by writing to the shared memory and gain root privileges. The fix, a guard page between the stack and other areas, came in 2.6.32.19, 2.6.34.4 and 2.6.35.2, although SUSE had offered a fix as early as 2004.

hß · 2009

Critical hole in the Linux kernel affects all versions since 2001

In 2009 Tavis Ormandy and Julien Tinnes from Google found a hole that affected all Linux kernels 2.4 and 2.6 since May 2001 and allowed local root privileges. With rarely used protocols such as Bluetooth, PPPoX or ISDN, pointers in the socket operations remained uninitialised, which could be exploited via sock_sendpage. Brad Spengler published the exploit “wunderbar_emporium”, which worked on a current Ubuntu 8.10.