MESSAGE
| DATE | 2010-12-08 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [NYLXS - HANGOUT] This is bad news - I have to do a kernel upgrade
|
Hi,
Dan Rosenberg published a new local root exploit for the kernel,
linked e.g. in this LWN article
http://lwn.net/Articles/419141/
and for our german readers on
http://www.heise.de/newsticker/meldung/OOPS-Root-Rechte-auf-Linux-1149512.html
The exploit itself uses 3 seperate security issues in chain, all
found by Nelson Elhage.
CVE-2010-4258[1]:
This is the core vulnerability, which can basically turn any user program
triggered Oops into a local privilege escalation. This problem affects
all SUSE Linux Enterprise and openSUSE products (but needs another
problem to trigger it.)
In the published exploit this Oops is caused by:
CVE-2010-3850[2]: Associating a ECONET address with any network
interface. This is possible in older SUSE products before SUSE Linux
Enterprise 11 SP1 and openSUSE 11.2.
CVE-2010-3849[3]: A kernel Oops caused by a NULL pointer dereference in
ECONET. This vulnerability does not affect any SUSE Linux or openSUSE
product, as we do not have the the sub-configuration of ECONET enabled that
are necessary to exploit this.
As the ECONET parts of this exploit are not effective on openSUSE and
SUSE Linux Enterprise, the published exploit will not work as-is.
However, as SUSE kernels are affected by CVE-2010-4258, an exploit could
be written that uses a different method to Oops the kernel.
To mitigate this issue until updates are available, you can switch your
kernel to cause a panic on any Oops by doing as root:
echo 1 > /proc/sys/kernel/panic_on_oops
We will be of course also be releasing updated kernel packages containing
fixes.
Ciao, Marcus
[1] http://support.novell.com/security/cve/CVE-2010-4258.html
[2] http://support.novell.com/security/cve/CVE-2010-3850.html
[3] http://support.novell.com/security/cve/CVE-2010-3849.html
|
|
