Patch alert! Easy-to-exploit flaw in Linux kernel rated 'high risk'

Urgent security triage needed

A flaw has been found in the way the Linux kernel loads ELF files.

If a malicious program is built as a Position Independent Executable (PIE), the loader can be exploited to map part of that application's data segment over the memory area reserved for its stack. This can result in memory corruption and possible local privilege escalation.

Red Hat and Debian are among Linux distros affected by the CVE-2017-1000253 vulnerability, which was discovered by cloud security firm Qualys.

Red Hat's advisory is here. Debian's list of affected releases – which have largely already been fixed – can be found here. Just run your usual package management tools to install the patched kernels and reboot.

Red Hat warned: "An unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system."

This issue affects Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 as well as some older versions of Red Hat Enterprise Linux 7. Embedded systems running Red Hat may also need updating. The Linux distro rates attack complexity as "low" but impact "high" – always a bad combination.

The flaw represents a possible mechanism for a hacker or other malicious party to step up from a normal user to root – e.g. you get a shell as an ordinary user via a compromised web application or another internet-facing service, and then use the above bug to take full control of the box. It can also be abused by logged-in users to gain administrative access over the machine.

Patching is straightforward, in this case, but deployment is the "hard" part as it'll involve a reboot. The vulnerability is nasty but it'd be a whole lot worse if it were remotely triggered, kinda like ShellShock and its ilk. This flaw does not fall into that category, fortunately.

Sysadmins are nonetheless advised to review the security of their systems and patch or at least mitigate against the vulnerability at their earliest opportunity. ®

Other stories you might like

  • Cheers ransomware hits VMware ESXi systems
    Now we can say extortionware has jumped the shark

    Another ransomware strain is targeting VMware ESXi servers, which have been the focus of extortionists and other miscreants in recent months.

    ESXi, a bare-metal hypervisor used by a broad range of organizations throughout the world, has become the target of such ransomware families as LockBit, Hive, and RansomEXX. The ubiquitous use of the technology, and the size of some companies that use it has made it an efficient way for crooks to infect large numbers of virtualized systems and connected devices and equipment, according to researchers with Trend Micro.

    "ESXi is widely used in enterprise settings for server virtualization," Trend Micro noted in a write-up this week. "It is therefore a popular target for ransomware attacks … Compromising ESXi servers has been a scheme used by some notorious cybercriminal groups because it is a means to swiftly spread the ransomware to many devices."

    Continue reading
  • Twitter founder Dorsey beats hasty retweet from the board
    As shareholders sue the social network amid Elon Musk's takeover scramble

    Twitter has officially entered the post-Dorsey age: its founder and two-time CEO's board term expired Wednesday, marking the first time the social media company hasn't had him around in some capacity.

    Jack Dorsey announced his resignation as Twitter chief exec in November 2021, and passed the baton to Parag Agrawal while remaining on the board. Now that board term has ended, and Dorsey has stepped down as expected. Agrawal has taken Dorsey's board seat; Salesforce co-CEO Bret Taylor has assumed the role of Twitter's board chair. 

    In his resignation announcement, Dorsey – who co-founded and is CEO of Block (formerly Square) – said having founders leading the companies they created can be severely limiting for an organization and can serve as a single point of failure. "I believe it's critical a company can stand on its own, free of its founder's influence or direction," Dorsey said. He didn't respond to a request for further comment today. 

    Continue reading
  • Snowflake stock drops as some top customers cut usage
    You might say its valuation is melting away

    IPO darling Snowflake's share price took a beating in an already bearish market for tech stocks after filing weaker than expected financial guidance amid a slowdown in orders from some of its largest customers.

    For its first quarter of fiscal 2023, ended April 30, Snowflake's revenue grew 85 percent year-on-year to $422.4 million. The company made an operating loss of $188.8 million, albeit down from $205.6 million a year ago.

    Although surpassing revenue expectations, the cloud-based data warehousing business saw its valuation tumble 16 percent in extended trading on Wednesday. Its stock price dived from $133 apiece to $117 in after-hours trading, and today is cruising back at $127. That stumble arrived amid a general tech stock sell-off some observers said was overdue.

    Continue reading

Biting the hand that feeds IT © 1998–2022