Here comes another local root vulnerability…

Yesterday a security advisory went around the world announcing another bug in the Linux kernel, specifically in the 2.6, 2.4 and 2.2 series. New kernels with the fix have been released in all three series. Linus apparently prefers to keep kernel bugs undisclosed until a stable kernel is out. The bug was reportedly addressed in an -rc kernel about two weeks ago, though I couldn’t find anything about it in the changelog.

In any case, it’s the latest in a series of fairly serious kernel bugs. There have been several ptrace bugs, and now there’s mremap. This one lets you write to kernel memory, so even if you’ve installed grsecurity or another kernel patch to improve security, it can bypass the patch and give you complete control of the machine. I know of no exploit that gains root for the previous mremap bug, though there is one that can stop the computer dead. An exploit for yesterday’s bug is already circulating online, but I haven’t tried it. I assume it’s something like the last one.

I suppose I’ll have to get used to this sort of thing. I still remember how the news about ptrace shocked me. Still, compare it with Windows bugs such as MS04–007, which lets someone run code on a remote machine. So far I’ve only seen an exploit that restarts the machine, but it was well commented, so perhaps even someone like me who doesn’t write C could adapt it to do something more useful than rebooting. It affects the Server service, which shares files and printers and is probably enabled by default on every Windows installation.

You might think I’m comparing apples and pears, but I’m talking about the security of the system as a whole. True, there are bugs in programs such as rsync that can give someone root remotely. But nobody makes you install rsync when you install Linux, whereas Windows has the service enabled by default. Also, Linux == kernel -> Linux != applications.

My parting advice? Update, update, and update again… I don’t see another way :]