Forgot your password?
typodupeerror
Security Linux IT

Linux Kernel Exploit Busily Rooting 64-Bit Machines 488

Posted by timothy
from the get-your-patch-on dept.
An anonymous reader writes "Running 64-bit Linux? Haven't updated yet? You're probably being rooted as I type this. CVE-2010-3081, this week's second high-profile local root exploit in the Linux kernel, is compromising machines left and right. Almost all 64-bit machines are affected, and 'Ac1db1tch3z' (classy) published code to let any local user get a root shell. Ac1db1tch3z's exploit is more malicious than usual because it leaves a backdoor behind for itself to exploit later even if the hole is patched. Luckily, there's a tool you can run to see if you've already been exploited, courtesy of security company Ksplice, which beat most of the Linux vendors with a 'rebootless' version of the patch."
This discussion has been archived. No new comments can be posted.

Linux Kernel Exploit Busily Rooting 64-Bit Machines

Comments Filter:
  • But wait (Score:3, Insightful)

    by drinking12many (987173) on Sunday September 19, 2010 @11:15PM (#33632006)
    I thought only windows got exploited this way.... oh thats right All OS's do.
    • Re:But wait (Score:5, Informative)

      by IICV (652597) on Monday September 20, 2010 @12:14AM (#33632424)

      It's a local user privilege escalation exploit. Every OS has those. What it means is that if someone can get in to your computer as a local user (or gain control of a process that runs as a local user, such as the web server process), then they can gain root access to your system.

      However, the first step - getting in as a local user - is really really hard on most servers. Unless you're handing out local user accounts to people left and right (like a university cluster or something), it's going to be nearly impossible for Joe Random Hacker to get control of a local user account.

      You know how it's generally held to be true that if you have physical access to a running machine, the only thing stopping you from getting root access to it is time? Well, the next step up (in terms of difficulty) is not having physical access, but having access to a local user account.

      The exploits that work on Windows, on the other hand, are ones where someone who doesn't even have local user privileges - who's just looking at your website - can get root access, like the one Slashdot posted here [slashdot.org].

      • Re:But wait (Score:5, Insightful)

        by man_of_mr_e (217855) on Monday September 20, 2010 @12:42AM (#33632572)

        Uhh.. dude. Seriously. Did you even think about this?

        Your web browser runs as a local user. If there is a flaw in your web browser (and all of them have had plenty), then they can use that flaw, just by looking at a web site, to gain root access to your machine using this vulnerability.

        So yes. This *IS* the kind of flaw that just looking at someones web site can exploit, if they can also attack your web browser (which is typically pretty easy to do as most people aren't always up to date).

        • Re:But wait (Score:5, Insightful)

          by owlstead (636356) on Monday September 20, 2010 @08:32AM (#33634442)

          As a home user, I'm always a bit aghast when people determine that preventing access to root is my biggest priority.

          If they've got access to my browser, this means that they now have access to all of my documentation, and have the ability to run programs (e.g. through my .bin and .profile files) including full access to the internet.

          I mean, they've got my data, they've got the power to run applications and they've got full internet access. I'm personally not that worried about root access - if they break through the browser barrier I'm basically f*cked already.

          (yes, yes, I know, SELinux and such could protect me if I configure them correctly. Not even I can easily do that however, and nobody that I know would go that far).

      • poorly described (Score:3, Interesting)

        by MikeFM (12491)

        What is annoying me about these issues is that they are described so poorly that I'm not certain if I have a problem. I run 64-bit Linux but no 32-bit code and there are no local users other than for the services I'm running (http and ssh). So do I need to take the time to do something or can I wait for a normal update?

        • Re: (Score:3, Interesting)

          by fluffy99 (870997)

          What is annoying me about these issues is that they are described so poorly that I'm not certain if I have a problem. I run 64-bit Linux but no 32-bit code and there are no local users other than for the services I'm running (http and ssh). So do I need to take the time to do something or can I wait for a normal update?

          Short answer - it depends on whether your kernel has the vulnerability. Seriously, Slashdot is the worst place to find out more into about vulnerabilities. At least it did give the CVE which you can use to get more details and determine if you're affected.

        • Re:poorly described (Score:5, Informative)

          by Runaway1956 (1322357) on Monday September 20, 2010 @02:40AM (#33632972) Homepage Journal
          Run the tool in TFA ./diagnose-2010-3081 Diagnostic tool for public CVE-2010-3081 exploit -- Ksplice, Inc. (see http://www.ksplice.com/uptrack/cve-2010-3081 [ksplice.com]) $$$ Kernel release: 2.6.32-24-generic !!! Not a RHEL kernel, will skip LSM method $$$ Backdoor in LSM (1/3): not available. $$$ Backdoor in timer_list_fops (2/3): checking...not present. $$$ Backdoor in IDT (3/3): checking...not present. If you're suspicious of the binary, download the source, examine it to satisfy yourself that it's not malicious, and compile it. It's not hard to figure out if you're affected - even a dummy like me can do it!
          • Re: (Score:3, Funny)

            Function names like wtfyourunhere_heee, p4tch_sel1nux_codztegfaddczda and datatypes like __yyrhdgdtfs66ytgetrfd as well as hex-code doesn't make the code look less suspicious.
            I can't be sure that the rootkit (or a different one) is not in there.

            You are a dummy for downloading from a http website without a checksum. No thank you.

            • You are a dummy for downloading from a http website without a checksum. No thank you.

              What exactly is the point of supplying a checksum by the same route/download method as the file in question? Surely if the file can be modified, so can the checksum. Maybe it would be useful if people got the checksum and verified it was the same checksum everyone else saw, then verified the file with it, but that just doesn't happen.

          • Re: (Score:3, Informative)

            by DMiax (915735)

            why the fuck do they need to

            #define __yyrhdgdtfs66ytgetrfd unsigned long long

            apart making the code horrible? Seems like an entry for IOCCC. I don't trust this check at all! Wtf is doing this?

            *((__yyrhdgdtfs66ytgetrfd *)(r1ngrrrrrrr + R0TDGFSRSLLSJ_SHSYSTGD)) = _m_cred[2];

            Regardless, it fails on my pc at

            _m_cpu_off = (__dgdhdytrg55)get_sym(PER_C_DHHDYDGTREM7765);

            A little search shows they just took the public exploit and mangled names plus other small changes. Are they joking?

  • by fluffy99 (870997) on Sunday September 19, 2010 @11:16PM (#33632014)

    Why does the summary and articles read like a paid advertisement for Ksplice?

  • Oh Noes (Score:5, Insightful)

    by symbolset (646467) on Sunday September 19, 2010 @11:18PM (#33632036) Journal

    Yes, there's an available rights escalation vulnerability in recent Linux Kernels that's best patched by updating your system with the latest updates. The breathless nature of the fine summary betrays an eagerness to get Linux admins to click the links before they've done so. I'd rather not. Social engineering is such a powerful exploit mechanism after all.

    The Windows geeks obviously will want to paint this as a native Linux vulnerability that they don't have - and it is marginally true. That's fine - but it's an escalation bug, not a remote root, and they've several dozen remote root bugs to close before they point fingers.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      The Windows geeks ... they've several dozen remote root bugs to close before they point fingers.

      Care to point them out?

      • The Windows geeks ... they've several dozen remote root bugs to close before they point fingers.

        Care to point them out?

        Just subscribe to the SANS newsletters - they point them out every week (for all OSes, not just Windows).

      • Re: (Score:3, Insightful)

        by symbolset (646467)

        >Care to point them out?

        No.

        I don't want them fixed. I am aware of several dozen remote root exploits for Windows and am sure there are hundreds I'm not aware of. But I don't have to prove it. I can say it, and Microsoft could sue me. Between the time they sued me and the time we got to court they would have to span two years of updates, in which they would have to admit several dozen remote root exploits and concede their case. They are there, and if you trawl the darker corners of the Internet yo

        • Moderation abuse (Score:3, Insightful)

          by symbolset (646467) *

          Y'know, sometimes there are posts that are poignant, interesting, on-topic, and yet are modded down as a troll for no better reason than people who have mod points are more interested in squelching challenging ideas. That's fine, and slashdot has a mechanism to deal with that, called Karma.

          Because I have good /. Karma I can call your attention to the parent post even though I believe it's been badly moderated. Because I'm a Slashdot subscriber, I get an extra point to add to this post, which calls attent

  • EH (Score:4, Insightful)

    by Anonymous Coward on Sunday September 19, 2010 @11:18PM (#33632040)

    This is a local exploit so I'm not horribly concerned and here is why.

    You should always treat your systems as if an exploit already exists for both remote and local connections.

    The systems I maintain are part of a bit of an elaborate network. There is a huge investment in controlling incoming and outgoing traffic as well as managing who actually has access to systems. While a local exploit a big deal it's not like there are a great number of places for users to inject this code. If someone could compromise an input vector and piggyback the exploit that still wouldn't get them very far. In fact, without knowing key details regarding the network infrastructure they would simply nab a host that could not reach the outside world.

    With that said we do have a bit of reliance on lbs, traffic inspection, firewalls and a good bit of monitoring equipment. However, there is a solid investment in specific purpose network and security protocols to accomplish these goals. In a bit of a cheaper shop I'm wondering what others do to maintain security and get some of the same tools. (I'm being very vague about our setup intentionally, but there have to be some decent foss network tools as well).

    • Re:EH (Score:5, Insightful)

      by GNUALMAFUERTE (697061) <almafuerte@NospaM.gmail.com> on Sunday September 19, 2010 @11:36PM (#33632166)

      THIS ^^^^^^

      I understand why you are posting as AC and being vague about it, I'm fucking paranoid about revealing details of the entrails of my network too.

      People don't understand how security works. If I told you the alarm in my office will fail to detect movement in zone 7 if you do X and Y, would you say that my office is absolutely compromised? No. I still have a security guy, bars, security doors, CCTV, and most things of real value inside is doubly secured (source code is encrypted, money is in the safe). A simple glitch doesn't mean I'm getting robbed.

      The problem is that there are many admins out there that do it by the book, and just think that patching systems is enough. You have to work with the OS to keep it secure, not just rely on it. Of course, securing a platform like windows is fucking impossible, that's why we don't use it (not even in the desktops). But if you have a reasonably secure OS, you have to use the rest of your architecture plus some level of monitoring and log-watching to keep things safe.

      • A simple glitch doesn't mean I'm getting robbed.

        But, you see, some anonymous reader said you are probably already rooted. He said probably, which indicates there is greater than a 50% chance you are already screwed, so it must be true. Nevermind that that the summary reads like an ad, looks very fishy, and is preaching doom and gloom, it got approved here, so believe it!!! .01% insecure from an inside job means YOU ARE SCREWED!
  • by Greyfox (87712) on Sunday September 19, 2010 @11:20PM (#33632052) Homepage Journal
    If hostile users have local access, you're pretty much boned anyway.
    • by Anonymous Coward on Sunday September 19, 2010 @11:24PM (#33632074)

      This doesn't require being physically close to the computer. For example, a web hosting company might give people limited permission ssh accounts on a web server, and the people could then use this exploit to get root.

    • by mlts (1038732) * on Sunday September 19, 2010 @11:28PM (#33632102)

      Pretty much Greyfox sums it up right there. The days of having hundreds to thousands of users with shell access on a university or public access machine are long gone. Instead, the focus of security has moved from keeping users out of root [1] to keeping people from getting to the machine in the first place, and if they get to the machine via a networking protocol, not being able to execute code in any meaningful context on the machine.

      The only time I'd worry about this is if someone could get a shell or execute code in an application's context (say they manage to do a buffer overrun and are able to stick a user shell on a port, for example.) However, this is what AppArmor and SELinux are designed to stop anyway, so even with root context, and attacker is limited to what they can do.

      [1]: This isn't to say that user to root priv exploits are something to be completely neglected, of course.

      • Re: (Score:3, Informative)

        by mysidia (191772)

        The exploit in question actually includes a SELinux bypass. SELinux and AppArmor are not as great as you think; they are understood well enough that hackers can defeat them, and they are deployed on enough systems that hackers write their exploits so these protections are defeated.

        • Re: (Score:3, Informative)

          by 0123456 (636235)

          SELinux and AppArmor are not as great as you think; they are understood well enough that hackers can defeat them, and they are deployed on enough systems that hackers write their exploits so these protections are defeated.

          SELinux and Apparmor can't do much if you have an exploit that allows you to execute arbitrary code inside the kernel (which I believe this does). But they'll certainly stop the kind of random buffer overflow exploit that's been the most common avenue of remote attack.

          • Re: (Score:3, Informative)

            by mysidia (191772)

            SELinux and Apparmor can't do much if you have an exploit that allows you to execute arbitrary code inside the kernel (which I believe this does). But they'll certainly stop the kind of random buffer overflow exploit that's been the most common avenue of remote attack.

            They will stop the simple use of a buffer overflow exploit to do something the program with the vulnerability couldn't do.

            That is: a buffer overflow exploit allows running arbitrary code in the context of the program. SELinux limits what

      • by langelgjm (860756) on Monday September 20, 2010 @12:00AM (#33632326) Journal

        The days of having hundreds to thousands of users with shell access on a university or public access machine are long gone.

        What makes you say that? All of the three universities I've been at in the past eight years have provided shell access for all students and faculty to at least one cluster, and often more than one. The current university uses Solaris, so this particular issue isn't relevant, but I would be more surprised to hear of a university that doesn't offer shell access.

  • Now Ksplice is really starting to piss me off. This is at least the fifth time we've get this kind of crap on slashdot.

    Besides that, this is an escalation vuln ... it's local, ok? Not a remote exploit. And, regardless of all that, there's already a fix, which was promptly released before this got out of hand.

    So, between the ksplice assholes that abuse each vulnerability that is published to blow it out of proportion and somehow imply that if you require ksplice to patch this without loosing your job (I mean

    • Re: (Score:2, Insightful)

      by sdasher (1586493)
      Actually, RHEL and CentOS have still yet to release a fix. So for your average Linux sysadmin out there, there still isn't an easy-to-use fix. Well, besides Ksplice anyway.
    • Ya (Score:5, Insightful)

      by Sycraft-fu (314770) on Monday September 20, 2010 @12:05AM (#33632366)

      Our UNIX admin has the philosophy that anyone with local access can get root if they want it bad enough. Security isn't done by presuming you've made that impossible. Rather security is done by making sure you don't give access to just anyone, and to monitoring what people do. Local escalation exploits are things to be fixed, since they can always make a remote exploit worse (someone exploits something remotely, gets unprivileged access, exploits the local exploit to get root) they aren't a critical threat usually.

      However I will say you don't make things much better when you start with name calling with regards to Windows and the people that run it. That smacks of being the sort of asshole that knows little about the other platform that you are painting them to be. That you have a preferred platform is great. One would hope it is based on good reasons. However name calling on another platform indicates it is more likely based on zealotry than anything else.

    • by shutdown -p now (807394) on Monday September 20, 2010 @12:29AM (#33632516) Journal

      it's local, ok? Not a remote exploit.

      Ironically, a local exploit is somewhat more serious for Unix systems, because Unix hosters are much more likely to give shell access to their customers (effectively giving "local" access), while the most a typical Windows hoster will do is let you connect with IIS admin console.

    • by RAMMS+EIN (578166) on Monday September 20, 2010 @03:00AM (#33633034) Homepage Journal

      ``assholes that don't understand shit about security and somehow think that this means that GNU/Linux is insecure''

      It _is_ insecure. There are plenty of vulnerabilities being found and reported, and there are several things that many distributions could do to improve security. To name a few examples, many distros ship with stack smashing protection and address space layout randomization disabled, and allow pages to be writable and executable by default. Also, usually, many operations are reserved to the root user, and the root user can do everything which means that more programs than necessary run as root, and root has more power than necessary. These are not the properties of secure systems; it's not even close to state of the art security.

      ``as bad as their shitty system''

      I am not sure that such derogatory language makes the world a better place. I'm not even sure comparing the security of Linux with that of Windows is useful. If you do compare them, you will find that, at the very least, Microsoft has improved the security picture on Windows a great deal. In some cases, such as running with reduced privileges by default and only elevating privileges for programs that need it, they have merely caught up with Linux systems. But since Windows Vista, Windows ships with address space layout randomization and non-executable pages (Microsoft calls it DEP) enabled for many libraries and executables. Newer versions of Internet Explorer (certainly 8, but also newer versions of 7 if I'm not mistaken) are among those applications, and also include a "protected mode" where most of the program can't do very much at all, and all potentially harmful operations are concentrated in a small, trusted kernel running in a separate process. These are the sort of security measures taken by a vendor who takes security seriously. On the *nix side, you will find this kind of stuff in OpenBSD and a few specialty hardened Linux distros, and that's about it. Ubuntu has AppArmor, but hardly uses it.

      If you look at vulnerabilities, like the privilege escalation vulnerability in the story, I would not be surprised to find that more of these are being found and reported in Linux than in Windows these days. What that means about the relative security of Linux and Windows, I don't know. But clearly, serious security flaws are being found in Linux. As far as I am concerned, Linux's security track record is far from stellar, and there certainly isn't a strong security culture that will make this better in the near future. Easily applied security measures (see first part of my post) are being left on the table, and we have far too much code running in all-powerful kernel mode for me to be comfortable with (just one data point: I have over 100 MB of kernel modules on my system, and on the order of tens of megabytes in the running kernel image).

      Considering all the above, I would certainly refrain from calling names or making derogatory remarks against users of non-Linux systems. I don't profess to know which system is the most secure, all things considered, but I'm a firm believer in not needlessly stepping on people's toes.

      Kind regards,

      Your friendly neighborhood Linux guy

  • First you need remote access to my home machine, which is behind a NAT'd router and doesn't expose any services outside. That means that drive-by scanning won't work, and even if it did you'd have to find your way in via the only open port - ssh.

    My systems in the commercial space are properly firewalled. It's a bad thing if anyone has shell access to them at all, let alone root.

    • NAT routers are nice... like a honey trap, but functional. Unless it's wireless, too... that's sort of like having a house with a decent heavy front door... but no roof.
    • Re: (Score:3, Informative)

      by mysidia (191772)

      You don't necessarily need shell access, just the ability to run a binary as any user.

      This could be done, for example, if it is a web server and there is a PHP script with a vulnerability. If a hacker can run arbitrary PHP code, then they can run code to accept an upload of the binary.

      Once the binary is uploaded to a world-writable directory such as /tmp or /var/lib/php/sessions, the hacker can use the ability to run arbitrary PHP code again to invoke fchmod(), make the binary executable then use th

  • Not running it... (Score:5, Insightful)

    by Dragoniz3r (992309) on Sunday September 19, 2010 @11:31PM (#33632118)
    Am I the only person who says "hell no" to running that "diagnosis" program? After looking through the code real quick, I have no interest whatsoever in running a program that performs the very exploit I'm supposed to be scared of, cuz I don't have time to make sure ksplite neutralized it properly. Also, since it's only a local exploit, I'm not concerned enough about it to run a diagnosis tool that implements it.

    And good lord god almighty, what 12 year old wrote this code, that they think having function names like put_your_hands_up_hooker() makes them cool?
    • by cpghost (719344)

      Am I the only person who says "hell no" to running that "diagnosis" program?

      Testing it in a quick throw-away VM (e.g. in VirtualBox) is always instructive though. Just don't run it on your real machine.

    • Re:Not running it... (Score:5, Informative)

      by radio4fan (304271) on Monday September 20, 2010 @02:25AM (#33632918)

      And good lord god almighty, what 12 year old wrote this code, that they think having function names like put_your_hands_up_hooker() makes them cool?

      This is copied directly from Ac1db1tch3z's exploit.

      So the answer is Ac1db1tch3z thinks function names like put_your_hands_up_hooker() makes him cool.

  • FUD (Score:5, Insightful)

    by proxima (165692) on Sunday September 19, 2010 @11:37PM (#33632180)

    Running 64-bit Linux? Haven't updated yet? You're probably being rooted as I type this.

    C'mon now. As others have pointed out, and has been mentioned earlier on /., this is a local root exploit. It's bad, it affects a lot of users (in theory), but to write this is to simply spread fear for most of those using Linux.

    Why? Because the systems that inexperienced users run also happen to be those with a few, generally trusted users. Think netbooks. Sure, all local root exploits are bad and should be patched asap. But that doesn't mean "you're probably being rooted as I type this". It means that a remote attacker needs user-level privileges (say, with a browser or plugin vulnerability) first. Since Ubuntu and probably other major distros have already patched this, and the default settings for updates on these systems is to check fairly frequently, most end users will have the patched kernel quickly.

    That leaves multi-user systems. The admins of these servers certainly benefit from finding out about the vulnerability asap, and they did (including through previous stories here). By now, though, most admins should have something in place if they don't have full trust in their users. If they don't, they should definitely be looking at whether this was exploited.

    The bottom line is that there are many local root exploits which come out every year. This is the latest one, with a patch already available. Responsible admins of multi-user systems are used to dealing with this, and home users are almost certainly going to be patched before it causes any issues. For them, the latest Flash vulnerability is more worrisome. Even the extremely rare remote exploit of a service isn't usually an issue, since most modern distros don't start much of anything by default (including ssh, IIRC).

  • Slashvertisement (Score:5, Insightful)

    by Cruciform (42896) on Monday September 20, 2010 @12:29AM (#33632518) Homepage

    As a long time user I get the option to disable advertising. I don't. I even whitelist Slashdot in Adblock because I support the site and the banner ads are rarely obnoxious.
    These poorly disguised articles-as-ads are quite annoying though. Just make KSplice pay for a banner like everyone else.

    • by DigiShaman (671371) on Monday September 20, 2010 @02:20AM (#33632898) Homepage

      I don't mind Slashvertisements, and in fact enjoy them on occasion. Unfortunately, they're passed off as a genuine grass-roots posting to the casual non-slashdot member. AKA astroturfing.

      If Slashdot would actually flag the story as a "Slashvertisement", I think we as a community would have far an away much MUCH more respect for the story and wouldn't think so much of it. That's the point really. Keep it honest and the intention transparent.

  • by adaviel (1189751) on Monday September 20, 2010 @02:45AM (#33632996) Homepage

    The situation appears to be exactly as described by Ksplice.
    CVE-2010-3081 has been discussed on RedHat forums and elsewhere.
    The Ac1db1tch3z exploit published on the full disclosure list http://seclists.org/fulldisclosure/2010/Sep/268 [seclists.org]
    does indeed appear to contain a backdoor (0p3n1ng th3 m4giq p0rt4l).
    From the comments, the vulnerability was found in 2008 and the exploit has been used by the author for some time, and may have been circulating in the underground. When the vulnerability was found and disclosed by Ben Hawkes, the exploit was published to a wider audience.
    A number of sysadmins may well have run the exploit on their systems to prove to themselves that this was a real threat. In doing so they may unknowingly have left a backdoor.
    More commonly, proof-of-concept exploits posted on full-disclosure lists are crafted by security researchers, do not contain backdoors, and are relatively easy to read. In this case, the disclosed exploit is crafted by a hacker, may well contain a backdoor, and is written with leetspeak runtime messages and obfuscated code.

    I admit I do not fully understand the code in the exploit or in the detection tool, or indeed the nature of the backdoor. However, on a Fedora 9 system, running the detector says there is no backdoor. After the exploit is run, the detector says there is a backdoor, so
    the exploit must have changed the state of the system in some way. The detector looks for 3 separate backdoors; the one on my
    test system disappears after reboot. As I thought the fix was to update the kernel to a patched version, which requires a reboot, I'm not sure how the backdoor could survive. I do not see how having the backdoor is riskier than having an unpatched system.

    I can say, though, that the vulnerability exists in stock kernels 2.6.25 - 2.6.36, and was back-ported by RedHat into 2.6.18 used
    in RHEL 5 (hence CENTOS 5). As stated by others, an unprivileged user account is required in order to exploit the vulnerability, which exists only on 64-bit x86 systems which also can run 32-bit code. One published mitigation step, which does not require a reboot, is to disable 32-bit compatibility mode by writing into /proc.

  • LOL (Score:3, Funny)

    by boxwood (1742976) on Monday September 20, 2010 @07:44AM (#33634136)

    did anyone check the source code for that diagnose command?

    static void put_your_hands_up_hooker(int argc, char *argv[])

    WTF?

"Hello again, Peabody here..." -- Mister Peabody

Working...