RDS Protocol Bug Creates a Linux Kernel Hole, Now Fixed 89
Trailrunner7 writes "The open-source Linux operating system contains a serious security flaw that can be exploited to gain superuser rights on a target system. The vulnerability, in the Linux implementation of the Reliable Datagram Sockets (RDS) protocol, affects unpatched versions of the Linux kernel, starting from 2.6.30, where the RDS protocol was first included." The article goes on to say, though, that "Linux installations are only vulnerable if the CONFIG_RDS kernel configuration option is set, and if there are no restrictions on unprivileged users loading packet family modules, as is the case on most stock distributions," and that Linus Torvalds has committed a fix.
A local exploit only (Score:5, Informative)
They should mention in the summary this is a local privilege escalation exploit only.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:A local exploit only (Score:5, Informative)
I'd expect this is a pretty common vulnerability out there.
Re: (Score:2, Informative)
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
That's why I like and appreciate user personalization in GNU/Linux. At expense of being modded down, imagine Gentoo Linux for example. The kernel and userspace are built mostly by the user and so, there is a lot of user generated entropy in it. That is good for security since we can't really say for sure if Gentoo is vulnerable to this attack or other attack. The kernel option is there, it depends if the user enabled it or not.
Re: (Score:2)
Seriously, get a grip. Most people will compile it using the default flags unless they got a reason to change it. That it doesn't involve everyone is roughly equivalent to other people on other distros hardening their machine by disabling stuff they dont' use.
Re: (Score:2)
Seriously, get a grip. Most people will compile it using the default flags unless they got a reason to change it
Well.. If everything is to be left defaulted, what is the point of installing Gentoo in the first place? ;)
People installing Gentoo know exactly what they want and want not. Otherwise it is just pointless to go all over the work that is required to install it..
Of course there is always the people initiating in Gentoo, but that happens to be a small and volatile userbase.
That it doesn't involve everyone is roughly equivalent to other people on other distros hardening their machine by disabling stuff they dont' use.
Notice that I never said that. However I think you might agree that people changing the system *a lot* are the exception. For the sake of t
Re: genkernel is actually quite nice (Score:2)
- that is my point. Still in Gentoo the percentage doesn't arrive anywhere near 100% because we have genkernel (to generate config and build the kernel automatically).
I like genkernel, place your custom kernel config for the right version in /etc/kernels (just cp any old one), run genkernel --menuconfig for a quick look if there is anything new if you want and done. I use git-sources on my desktop and change kernel frequently and genkernel saves time when (ab)using a _custom_ kernel. And apparently "# CONFIG_RDS is not set"..
Re: (Score:2)
There are plenty of situations where RDS or SCTP would be useful but aren't used. Which is a damn shame. What is the point of having a bunch of solutions to the major networking problems of today if nobody uses them?
(And, to be fair, apps don't make much use of these protocols because routers don't often support them. They're good for LANs and extranets, though. However, perhaps that means we should try bullying the router companies into adding support.)
Re:A local exploit only (Score:5, Funny)
Listen, not a year goes by, not a year, that I don't hear about some escalator accident involving some bastard kid which could have easily been avoided had some parent - I don't care which one - but some parent conditioned him to fear and respect that escalator.
Re: (Score:1)
Re:A local exploit only (Score:5, Insightful)
Local exploits become remote exploits througha vulnerable service or bad passwords. Just because something can only be done locally means nothing. It just means all I need to do is gain any sort of access then use the exploit. Instant root. And all I needed was just the ability to run a bit of my code. Or if I've previously gotten access in but not used it because running things as "nobody" isn't terribly useful, now with the ability to get root makes it very useful.
It's the same sort of thing that let that jailbreakme.com thing work - Safari downloads a PDF, the PDF display code tries to display it and fails, and runs the exploit code. Exploit code runs as Safari, uses a priviledge escalation hole to get root access, then does lal the jailbreak stuff as root.
Re: (Score:2)
Browser based exploits are generally considered remotely exploitable for user devices. They can be placed anywhere on the net.
Good luck getting this one to be exploited via the browser automatically.
Re: (Score:2)
Good luck getting this one to be exploited via the browser automatically.
Put it on a web advertisement network.
Re:A local exploit only (Score:4, Interesting)
That kind of attitude makes me upset because I endure a lot of it where I work. A local root exploit is the hard part of owning a server. Getting
unprivileged access through some vulnerability is comparatively a piece of cake.
No need to worry unless you use shared hosting (Score:1)
Re: (Score:2)
An explanation of what the exploit is, is not excuse.
All modern OS have these problems, the reality is we get speed or security and everyone has chosen speed. Maybe in 40 more years we will have the cpu cycles to waste.
Re: (Score:2)
If only there were some way for him to control what goes in the kernel.
Re: (Score:2)
Perhaps he should write his own version control system.
Fixing a hole where the rain gets in... (Score:5, Informative)
Gives new meaning...
Recommendation:
Users should install updates provided by downstream distributions or apply the committed patch [3] and recompile their kernel.
Preventing the RDS kernel module from loading is an effective workaround. This can be accomplished by executing the following command as root:
echo "alias net-pf-21 off" >
Re: (Score:3, Insightful)
Better question do any distros ship with this on by default?
They mention 10.04, but do not say if they had to enable it first. I guess I will have to check what modules my desktop has at home to see.
Re: (Score:3, Informative)
Re: (Score:2)
You see, this is what I don't like about most Linux distros. There's way too much crap turned on by default. This protocol is basically useful only in a cluster computing environment, which represents maybe one, maybe two percent of the installed base of even a frequently clustered OS like Linux (and only because each admin runs thousands of usually identical boxes). Sure, security may ultimately be the responsibility of the users, but it's downright reckless and irresponsible to have esoteric protocols
Re: (Score:2, Interesting)
Just tried on my home machine (Ubuntu 10.04 64 bit) and it couldn't get the root shell. It's running 2.6.32-25-generic.
[*] Linux kernel >= 2.6.30 RDS socket exploit
[*] by Dan Rosenberg
[*] Resolving kernel addresses...
[+] Resolved rds_proto_ops to 0xffffffffa0bc4860
[+] Resolved rds_ioctl to 0xffffffffa0bbd000
[+] Resolved commit_creds to 0xffffffff8108aee0
[+] Resolved prepare_kernel_cred to 0xffffffff8108b2c0
[*] Overwriting function pointer...
[*] Triggering payload...
[*] Res
Re: (Score:2, Informative)
Re: (Score:2)
MMMmmm sounds like a perfect transport layer for a botnet...now if I could just break into the server...
Oh wait.
Nevermind.
-Hack
Re: (Score:2, Informative)
I hate it when I see an advice like that. Linux is an open system. We should understand what are we doing when running a command like that as root. Running that command means that you tell to kernel module loading mechanism that it should not load module with name net-pf-21. My man page for modprobe says th
Re: (Score:2, Informative)
"net-pf" is a common prefix that refers to network packet families. You have an alias file at /lib/modules/[kernel version]/modules.alias that contains a number of entries like this. This is actually a format that is hard-coded into the kernel:
http://lxr.linux.no/#linux+v2.6.36/net/socket.c#L1196
The workaround is perfectly valid.
Re: (Score:3, Informative)
Re:Note to linux devs (Score:5, Insightful)
If you release early and you release often, you will release a big piece of sh^H^H code with a lot of bugs.
Funny how Microsoft releases late and releases seldom and has the same problem...
Re: (Score:3, Informative)
Nope. The usual Microsoft nonsense is still alive and well in 2010.
Re: (Score:3, Informative)
Yeah, it's 2010, and every Tuesday my computer bitches about how I have updates waiting to be installed...
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Of course what you don't know is that this issue has been known by the kernel team and unreported for at least 9 days.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3904 [mitre.org]
Notice the "Assigned" date, 10/12/2010, that's the date the CVE was created for this flaw and it was likely known and reported several days before that.
What this means is that the kernel team knew of the flaw, it was reported in secret, and they kept it a secret while they researched a fix. So people were vulnerabile for almsot 2 we
OMG! (Score:1)
Re: (Score:2)
When someone is claiming the flaw was fixed "overnight", yeah.. nine whole days.. and that's at LEAST 9 whole days.
There is this myth that flaws in linux are fixed within hours and ditributed to everyone instantly and everyone is safe all the time... There is also a myth that flaws are never kept secret and are fully disclosed as soon as found so that people can apply workarounds.
Both myths are wrong in most cases, as most critical bugs are embargoed from publication, sometimes for months. Then it's "anno
Re: (Score:2)
supposedly that was requested by the reporter (although who knows with the ac post :) )
http://linux.slashdot.org/comments.pl?sid=1833084&cid=33978900 [slashdot.org]
Re: (Score:2)
Doesn't matter who requested it. It was deliberately kept secret for over a week. This happens *a lot* in open source, and sometimes the time frame is months.
My point is this:
1) Everyone embargoes vulnerabilities, including open source developers. Complaining because closed source vendors do it is the pot calling the kettle black.
2) Too many people believe the myth that bugs in Linux are fixed and distributed "overnight", because few people know that #1 is true.
This is why I stick to older kernels (Score:1, Funny)
2.2.26 is still working great for me, thanks!
Re: (Score:2, Flamebait)
If by "immediately fixed" you mean nearly two weeks being kept secret by the kernel team while they worked on it, and you were vulnerable.. and if by "distributed overnight" you mean probably several more days before the various distros make it availble...
This bug was reported to the kernel team on 10/12, not yesterday.
Re: (Score:3, Insightful)
And meanwhile, since practically nobody and nothing actually uses that protocol, just disabe it unless/until you apply the update.
Re: (Score:2)
Yes, that would have been great, had people known about the vulnerability when it was discovered. Instead, it was kept secret for nearly 2 weeks.
Re: (Score:2)
Re: (Score:2)
Saying as such would let criminals know the issue exists before the CVE was even posted. You might as well have just said "hey everyone, there's a security exploit here that we haven't figured out how to fix". What is the point except for giving criminals an extra week to come up with a working exploit.
now fixed? (Score:2)
Re: (Score:3, Informative)
Clearing up some questions... (Score:5, Informative)
Sorry for the Anonymous Coward reply, I don't have an account in my name. I'm the researcher who discovered the vulnerability and published it. Just thought I'd clear up a few issues:
1. Stock installations of Ubuntu, Debian, Fedora, Red Hat, Arch, Slackware, and SuSE (and probably more) >= 2.6.30 are (or were) all vulnerable to the issue. Ubuntu has already issued an update, which is why some people can't get the exploit working on their Ubuntu machines. Even if the proof-of-concept doesn't work on your machine, if you have an unpatched machine that compiles RDS as a module, you are vulnerable and should patch.
2. Just because something is "compiled as a module" doesn't mean you have to explicitly have an administrator load it in order for it to be used. Networking protocols can be loaded at runtime by unprivileged users on nearly every distribution, including RDS. This is part of a broader security problem in the Linux world that should be improved.
3. No one should be complaining about the week-long period after reporting before disclosure. The Linux security folks upstream would have published the fix the day I reported the issue, except I specifically requested an embargo period of one week, during which downstream distributions could prepare updates. If I hadn't requested this embargo, then the fix would have been published immediately, but distribution users would have had to wait for their respective distributions to put together updates.
Not reading the entire sentence as usual (Score:2)
You see what happens? (Score:1)
goto repeat;
See? If gotos are outlawed, only outlaws will have gotos.
SELinux (Score:1)
Would SELinux not protect against this?
"Linux Operating System" (Score:2)
"The open-source Linux operating system"
LINUX IS A FUCKING KERNEL. The distros comprise the operating system.
Until /. can make this distinction and keep it consistent (and totally disavow any article containing the phrase 'Linux Operating System') this site should not be operating as any sort of distribution site.
It's just as bad as Fox with the spouted nonsense in the actual story.
Sorry, Tako (octopus,) you need to lose your geek-cred license for this site until your brain-dead editors can get their shit r