Local Root Hole in Linux Kernels

Please create an account to participate in the Slashdot moderation system

Local Root Hole in Linux Kernels 503

Posted by michael on Tuesday March 18, 2003 @04:09PM from the keep-those-users-down dept.

xepsilon writes "A local Linux security hole using ptrace has been discovered that allows a potential attacker to gain root privileges. Linux 2.2.25 has been released to correct this security hole, along with a patch for 2.4.20-pre kernels. 2.4.21 ought to contain this fix, once it is released. 2.5 is not believed to be vulnerable to this security hole. See this email from Alan Cox for details, and a patch."

This discussion has been archived. No new comments can be posted.

Local Root Hole in Linux Kernels

Search 503 Comments Log In/Create an Account

Comments Filter:

A bug!?!?11 (Score:0, Funny)

by Anonymous Coward writes: on Tuesday March 18, 2003 @04:12PM (#5538899)

... must be Microsoft's fault since it's posted on /.

Share
twitter facebook
How is Microsoft responsible? (Score:5, Funny)

by jmulvey ( 233344 ) writes: on Tuesday March 18, 2003 @04:12PM (#5538900)

With all the brainpower on /. I'm sure we can discover a way.

Share
twitter facebook
Got Root? (Score:5, Funny)

by FAngel ( 641209 ) writes: on Tuesday March 18, 2003 @04:12PM (#5538903)

Got Root?

Share
twitter facebook
It's Tuesday (Score:5, Funny)

by Anonymous Coward writes: on Tuesday March 18, 2003 @04:13PM (#5538916)

Journal Entries:

(looks at watch) its monday again... time to go patch my IIS

(looks at watch) its tuesday again... time to go patch linux.

Share
twitter facebook
Re:Got Root? (Score:5, Funny)

by Anonymous Cow herd ( 2036 ) writes: on Tuesday March 18, 2003 @04:14PM (#5538921) Homepage

I do now >:)

Parent Share
twitter facebook
This has to be erroneus. (Score:0, Funny)

by Anonymous Coward writes: on Tuesday March 18, 2003 @04:15PM (#5538925)

After all, Linux is perfect, right? Linux has NO vulnerabilities. It's that OS from Bill that is buggy, right?

Share
twitter facebook
Re:Got Root? (Score:3, Funny)

by cyb97 ( 520582 ) writes: <cyb97@noxtension.com> on Tuesday March 18, 2003 @04:15PM (#5538928) Homepage Journal

Just give me a minute ;-)

Parent Share
twitter facebook
Love the headline (Score:4, Funny)

by L. VeGas ( 580015 ) writes: on Tuesday March 18, 2003 @04:17PM (#5538950) Homepage Journal

Lo-Cal Root Hole in Linux Kernels

I think I saw this in an advertisement for granola.

mmmm... breakfasty

Share
twitter facebook
Hole Found in Linux Server (Score:5, Funny)

by ch-chuck ( 9622 ) writes: on Tuesday March 18, 2003 @04:18PM (#5538954) Homepage

(Server Room, DP) A hole was found in 'cypress', one of the principle Linux file, email and web servers of Brapco Corp early today. "We were dusting out around the back", said Mike Koyro, IT manager of Brapco, "and there it was, right by the power supply." The hole was quickly verified by other members of the IT dept as "really there". Speculation that it may be a screw hole was quickly dispelled when Frank, chief scripting officer, pointed out it didn't have any threads, and no screws were found loose anywhere nearby. "If someone got in here and drilled it during the night, they sure did a clean job - there's no shavings on the floor and the hole has no burrs" observed Mike. "It was either a professional job, with a sharp bit and machining oil, or a manufacturing defect". Calls to Linux Security were unanswered as of press time.

Share
twitter facebook
IT'S IN ENGLISH!!! (Score:5, Funny)

by strredwolf ( 532 ) writes: on Tuesday March 18, 2003 @04:19PM (#5538965) Homepage Journal

Haleulia and pass the green beer. It's not in Welsh.

BTW: If you haven't read, or tried to read, Alan's blog you won't get the joke.

Parent Share
twitter facebook
Hrm (Score:4, Funny)

by B3ryllium ( 571199 ) writes: on Tuesday March 18, 2003 @04:21PM (#5538984) Homepage

I guess they were just trying to out-do the IIS hole [cert.org].

Ah well ... there's always "linux single" ... :)

Share
twitter facebook
Re:How is Microsoft responsible? (Score:5, Funny)

by lavalyn ( 649886 ) writes: on Tuesday March 18, 2003 @04:22PM (#5538994) Homepage Journal

Microsoft would have a monopoly on privilege escalation exploits if not for Linux.

Parent Share
twitter facebook
Re:Huh (Score:4, Funny)

by ageOfWWIV ( 641164 ) writes: on Tuesday March 18, 2003 @04:26PM (#5539031)

We're not patching, we're in denial.

Parent Share
twitter facebook
Re:This has to be erroneus.(aehm erroneous) (Score:1, Funny)

by Anonymous Coward writes: on Tuesday March 18, 2003 @04:27PM (#5539040)

English is my second language, but I`m pretty sure
it should be erroneous.
Or was that on purpose? That`d be funny.

Parent Share
twitter facebook
Huh? (Score:0, Funny)

by Anonymous Coward writes: on Tuesday March 18, 2003 @04:27PM (#5539044)

Linux has security problems? I've been reading this site for so long, I thought that was only in Microsoft's domain.

Share
twitter facebook
Re:How is Microsoft responsible? (Score:5, Funny)

by kfg ( 145172 ) writes: on Tuesday March 18, 2003 @04:27PM (#5539047)

I think the late George Mallory put it rather succinctly:

"Because they're there."

On the other hand, in the words of Voltaire:

"If Microsoft didn't exist it would be necessary to invent them."

However, regarding the current kernel situation I think my deeply missed old granny put it best:

"Oh fuck."

KFG

Parent Share
twitter facebook
Re:Kernel Patches (Score:2, Funny)

by kfg ( 145172 ) writes: on Tuesday March 18, 2003 @04:32PM (#5539086)

Who's a sysadmin to trust?

Ummmmm, Ghostbusters?

KFG

Parent Share
twitter facebook
Re:It's Tuesday (Score:3, Funny)

by charon_on_acheron ( 519983 ) writes: on Tuesday March 18, 2003 @04:35PM (#5539116) Homepage

Four day week, huh? Must be nice. :^P

Parent Share
twitter facebook
Re:Known exploits? (Score:3, Funny)

by Soko ( 17987 ) writes: on Tuesday March 18, 2003 @04:49PM (#5539230) Homepage

The Linux 2.2 and Linux 2.4 kernels have a flaw in ptrace. This hole allows
local users to obtain full privileges. Remote exploitation of this hole is
not possible. Linux 2.5 is not believed to be vulnerable.

It isn't a remote exploit. Anyone who is foolish enough to attempt to h4X0r your b0X0rz with this vulnerability is within the normal attack range of a LART [bofh.net].

Please, do patch any affected machines you have as soon as possible, but don't *ahem* panic.

Soko

Parent Share
twitter facebook
Re:IT'S IN ENGLISH!!! (Score:3, Funny)

by cyb97 ( 520582 ) writes: <cyb97@noxtension.com> on Tuesday March 18, 2003 @04:56PM (#5539300) Homepage Journal

Like the welsh doesn't use any excuse to get drunk?
Come one grow up! Anybody that knows about st. paddy uses it as an excuse to get smashed on a monday!

Parent Share
twitter facebook
In the meantime... (Score:5, Funny)

by TheSHAD0W ( 258774 ) writes: on Tuesday March 18, 2003 @04:59PM (#5539318) Homepage

Until the patch has been tested and distributed, you can prevent the bug from being exploited by locking the door to your office.

Share
twitter facebook
Huh? (Score:3, Funny)

by FireballFreddy ( 472710 ) writes: on Tuesday March 18, 2003 @05:05PM (#5539373)

St. Patrick's Day, a perfectly valid and socially acceptable excuse to get rip-roaring pissed, and you say it's *only* for the Irish? I'm sorry, please hand in your geek membership card. You aren't allowed to post here anymore.

Parent Share
twitter facebook
Re:No need to panic... (Score:5, Funny)

by Christopher_G_Lewis ( 260977 ) writes: on Tuesday March 18, 2003 @05:05PM (#5539376) Homepage

I have absolutely no need to fear.

I run a box with no ethernet connection, no keyboard and no monitor.

When I want to be *extra* careful, I run it without the powercord. :-)

Parent Share
twitter facebook
Re:Huh? (Score:3, Funny)

by vsprintf ( 579676 ) writes: on Tuesday March 18, 2003 @05:16PM (#5539472)

Linux has security problems? I've been reading this site for so long, I thought that was only in Microsoft's domain.

We do want to make Windows users feel at home as they migrate to a Linux desktop. We don't expect 'em to go cold turkey right away.

Parent Share
twitter facebook
Re:This has to be erroneus. (Score:3, Funny)

by zebs ( 105927 ) writes: on Tuesday March 18, 2003 @05:24PM (#5539551) Homepage

After all, Linux is perfect, right? Linux has NO vulnerabilities. It's that OS from Bill that is buggy, right?

Its bugs from code Billy-boy wrote under a pseudonym

Parent Share
twitter facebook
Re:How is Microsoft responsible? (Score:5, Funny)

by kasperd ( 592156 ) writes: on Tuesday March 18, 2003 @05:33PM (#5539628) Homepage Journal

Microsoft would have a monopoly on privilege escalation exploits

No, Microsoft has a bulletproof way to prevent privilege escalations. They simply make sure the attacker gets all privileges at once, then there is nothing to escalate.

Parent Share
twitter facebook
Tux is Welsh!!! (Score:5, Funny)

by schon ( 31600 ) writes: on Tuesday March 18, 2003 @05:35PM (#5539635)

I know "Cymru" means "Welsh" but that's about it.

Tux, the beloved Linux mascot is Welsh!

It's true! Tux is a penguin..

Penguin is derived from two Welsh words: Pen (head) and Gwynn (white)...

So (besides Alan) there is another link between Wales and Linux.

(That, and I've tripled your knowledge of the Welsh language :o)

Parent Share
twitter facebook
Re:I'm not going to patch. (Score:4, Funny)

by gosand ( 234100 ) writes: on Tuesday March 18, 2003 @05:38PM (#5539655)

Have you considered the possibility of someone exploiting a non-root remote hole on your box and now having the ability to escalate themselves to root?
Well, I, ahhh....
Shut up!
Would someone please mod my previous post down as "fingers faster than brain"?
Thank you.

Parent Share
twitter facebook
Re:Got Root? (Score:5, Funny)

by wirelessbuzzers ( 552513 ) writes: on Tuesday March 18, 2003 @05:48PM (#5539726)

I do now >:)

I believe you mean "#:)"

Parent Share
twitter facebook
Re:This has to be erroneus. (Score:3, Funny)

by rusty spoon ( 564695 ) writes: on Tuesday March 18, 2003 @06:25PM (#5540014) Homepage

Yeah, that William H. Torvalds III has done a lot of damage with his weasly little kernel hacks, dammit.

Parent Share
twitter facebook
Re:Tux is Welsh!!! (Score:3, Funny)

by Large Green Mallard ( 31462 ) writes: <lgm@theducks.org> on Tuesday March 18, 2003 @07:32PM (#5540472) Homepage

So Alan's significant other Telsa Gwynne is half penguin?

Kinky :)

Parent Share
twitter facebook
And the obligatory.. (Score:2, Funny)

by mivok ( 621790 ) writes: on Tuesday March 18, 2003 @08:02PM (#5540646) Homepage

OpenBSD isnt vulnerable :P

Share
twitter facebook
Re:A bug!?!?11 (Score:3, Funny)

by t0ny ( 590331 ) writes: on Tuesday March 18, 2003 @10:58PM (#5541577)

NOW linux is ready for the desktop

Parent Share
twitter facebook

There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.

Local Root Hole in Linux Kernels 503

Local Root Hole in Linux Kernels More Login

Local Root Hole in Linux Kernels

A bug!?!?11 (Score:0, Funny)

How is Microsoft responsible? (Score:5, Funny)

Got Root? (Score:5, Funny)

It's Tuesday (Score:5, Funny)

Re:Got Root? (Score:5, Funny)

This has to be erroneus. (Score:0, Funny)

Re:Got Root? (Score:3, Funny)

Love the headline (Score:4, Funny)

Hole Found in Linux Server (Score:5, Funny)

IT'S IN ENGLISH!!! (Score:5, Funny)

Hrm (Score:4, Funny)

Re:How is Microsoft responsible? (Score:5, Funny)

Re:Huh (Score:4, Funny)

Re:This has to be erroneus.(aehm erroneous) (Score:1, Funny)

Huh? (Score:0, Funny)

Re:How is Microsoft responsible? (Score:5, Funny)

Re:Kernel Patches (Score:2, Funny)

Re:It's Tuesday (Score:3, Funny)

Re:Known exploits? (Score:3, Funny)

Re:IT'S IN ENGLISH!!! (Score:3, Funny)

In the meantime... (Score:5, Funny)

Huh? (Score:3, Funny)

Re:No need to panic... (Score:5, Funny)

Re:Huh? (Score:3, Funny)

Re:This has to be erroneus. (Score:3, Funny)

Re:How is Microsoft responsible? (Score:5, Funny)

Tux is Welsh!!! (Score:5, Funny)

Re:I'm not going to patch. (Score:4, Funny)

Re:Got Root? (Score:5, Funny)

Re:This has to be erroneus. (Score:3, Funny)

Re:Tux is Welsh!!! (Score:3, Funny)

And the obligatory.. (Score:2, Funny)

Re:A bug!?!?11 (Score:3, Funny)

Related Links Top of the: day, week, month.

Slashdot Top Deals

Slashdot