| Forum Home | ||||
| PC World Chat | ||||
| Thread ID: 87163 | 2008-02-11 00:33:00 | Linux: Kernels < 2.6.24.1 local root exploit | Erayd (23) | PC World Chat |
| Post ID | Timestamp | Content | User | ||
| 639340 | 2008-02-11 00:33:00 | Most major distribution kernels at version 2.6.24.1 or lower are vulnerable to an exploit that results in the attacker gaining root priveleges. Note that the attacker requires a system account - it can't be exploited remotely. Run this in a standard user shell to see if you are vulnerable: e_rsh_x86 (osiris.erayd.net) e_rsh_x86_64 (osiris.erayd.net) Run this in a root shell to patch kmem directly (this patches the vulnerability without requiring a reboot, but doesn't fix it permanently). e_rsh_x86_livekmempatch (osiris.erayd.net) e_rsh_x86_64_livekmempatch (osiris.erayd.net) To permanently fix this, either compile a kernel without vmsplice or wait for the latest kernel update from your distro's security repositories. If anyone is interested in the source, I compiled the above binaries from these: 2.6.x_vmsplice_localroot_shell.c (osiris.erayd.net) 2.6.x_vmsplice_localroot_shell_kmem-live-disable.c (osiris.erayd.net) |
Erayd (23) | ||
| 639341 | 2008-02-11 00:51:00 | Edit: Just goes to show how good opensource patching is - the Debian people already have a patch in their source tree, and it should hit the main push repositories shortly. Second-tier push mirrors should have it soon afterwards, and all pull mirrors should have the patch by tomorrow sometime. | Erayd (23) | ||
| 639342 | 2008-02-11 03:54:00 | The upstream kernel patch (git.kernel.org fb804f49cbc44) for this, if anyone wants to recompile. | Erayd (23) | ||
| 639343 | 2008-02-13 09:28:00 | Thank Bletch :) None of my machines are multi-user but am upgrading anyway. One bad line in thousands can do so much damage in IT. Fortunately in large open source projects the community generally closes the hole within a day of any serious vulnerability. |
TGoddard (7263) | ||
| 1 | |||||