RDS Protocol Bug Creates a Linux Kernel Hole, Now Fixed 89
Trailrunner7 writes "The open-source Linux operating system contains a serious security flaw that can be exploited to gain superuser rights on a target system. The vulnerability, in the Linux implementation of the Reliable Datagram Sockets (RDS) protocol, affects unpatched versions of the Linux kernel, starting from 2.6.30, where the RDS protocol was first included." The article goes on to say, though, that "Linux installations are only vulnerable if the CONFIG_RDS kernel configuration option is set, and if there are no restrictions on unprivileged users loading packet family modules, as is the case on most stock distributions," and that Linus Torvalds has committed a fix.
Re:A local exploit only (Score:3, Insightful)
Re:A local exploit only (Score:3, Insightful)
Re:Note to linux devs (Score:5, Insightful)
If you release early and you release often, you will release a big piece of sh^H^H code with a lot of bugs.
Funny how Microsoft releases late and releases seldom and has the same problem...
Re:Fixing a hole where the rain gets in... (Score:3, Insightful)
Better question do any distros ship with this on by default?
They mention 10.04, but do not say if they had to enable it first. I guess I will have to check what modules my desktop has at home to see.
Re:Note to linux devs (Score:3, Insightful)
Re:A local exploit only (Score:5, Insightful)
Local exploits become remote exploits througha vulnerable service or bad passwords. Just because something can only be done locally means nothing. It just means all I need to do is gain any sort of access then use the exploit. Instant root. And all I needed was just the ability to run a bit of my code. Or if I've previously gotten access in but not used it because running things as "nobody" isn't terribly useful, now with the ability to get root makes it very useful.
It's the same sort of thing that let that jailbreakme.com thing work - Safari downloads a PDF, the PDF display code tries to display it and fails, and runs the exploit code. Exploit code runs as Safari, uses a priviledge escalation hole to get root access, then does lal the jailbreak stuff as root.
Re:A local exploit only (Score:2, Insightful)
That's why I like and appreciate user personalization in GNU/Linux. At expense of being modded down, imagine Gentoo Linux for example. The kernel and userspace are built mostly by the user and so, there is a lot of user generated entropy in it. That is good for security since we can't really say for sure if Gentoo is vulnerable to this attack or other attack. The kernel option is there, it depends if the user enabled it or not.
Re:If it were MS, it would be months later (Score:3, Insightful)
And meanwhile, since practically nobody and nothing actually uses that protocol, just disabe it unless/until you apply the update.