Another Linux Kernel Vulnerability Leading To Local Root From Unprivileged Processes

Zarathustra[H]

Zarathustra[H]

Extremely [H]
Joined
Oct 29, 2000
Messages
38,835
How about that. In a world where Microsoft puts off a patch Tuesday in February with known 0-day exploits in the wild, a new Linux exploit has been discovered, and fixed in Git a week before it was announced giving distribution managers time to patch it in their repositories. You have to love efficiency.

This must have been why I got a new kernel on my Ubuntu server install and Linux Mint desktop yesterday.

This local root vulnerability is present in Linux kernel releases going back at least to 2006 but potentially to 2005 when the code was first introduced. It affects kernel builds with CONFIG_IP_DCCP, which is the case for many distribution kernels. Checking my Fedora 25 kernel right now, it's enabled. DCCP in this context is short for the Datagram Congestion Control Protocol.
 
Fixed before it was announced but still unfixed for 12 years...

That would be like MS having the same bugs in Windows 10 as they do in XP. Possible I suppose but they would catch a lot of criticism
 
It's also been marked "experimental" for most of those 12 years, with a recommended setting of "n" even in 4.9.6. With great power comes great responsibility, especially if you're rolling your own kernel.
 
ecmaster76 said:
Fixed before it was announced but still unfixed for 12 years...

That would be like MS having the same bugs in Windows 10 as they do in XP. Possible I suppose but they would catch a lot of criticism
Click to expand...

There is no such thing as bug/exploit free software. There are millions of vulnerability exploits in software and operating systems out there. They are not a problem until they are discovered and published. Once this happens it's only a matter of time until someone tries to exploit them.

Response time to patch a vulnerability is measured to first known discovery time for a reason.
 
Local root? Those are so common that they don't even give me gas any more.
 
You must log in or register to reply here.
Back
Top