Root Exploit For NVIDIA Closed-Source Linux Driver 548
possible writes, "KernelTrap is reporting that the security research firm Rapid7 has published a working root exploit for a buffer overflow in NVIDIA's binary blob graphics driver for Linux. The NVIDIA drivers for FreeBSD and Solaris are also likely vulnerable. This will no doubt fuel the debate about whether binary blob drivers should be allowed in Linux." Rapid7's suggested action to mitigate this vulnerability: "Disable the binary blob driver and use the open-source 'nv' driver that is included by default with X."
useless suggestion (Score:4, Insightful)
This is as useless as suggesting "Install Linux" when a Windows vulnerability has been found!
Re:useless suggestion (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
As an aside, I wonder why there isn't some kind of 'backup X' configuration with the vesa driver for those who have a problem with their driver?
At first I made a mistake and used fbdriver instead of the vesa driver trying to have X running to be able to use a web browser to get the closed source driver, this was frustrating, especially as Kubuntu starts with some kind of image during the boot, so I knew that it was
Re: (Score:2)
There is. It's called creating a simple config with the vesa driver. All servers look in the same place for their config file by default so there's not any good way to do this beyond providing you with a config file that will give you a failsafe. The X server can't be counted on to detect if its output is what it ought to be, so there's no automated way it could
Re: (Score:2)
Re: (Score:2, Interesting)
Re:better suggestion (Score:5, Funny)
Well duh! Our only course of action is to bitch about it on
Of course this now gives me some ammo against the Linux+nVidia fans I personally know. As Nelson Muntz would say: "Ha ha".
Re: (Score:2)
This is as useless as suggesting "Install Linux" when a Windows vulnerability has been found!
Not really. You assume that this is somehow incredibly difficult. In actuallity the difficult part has already been done. That happened when the end user installed the binary only nVidia driver. Going back to the driver
supplied by the distribution should be easy by comparison.
Sure you're not going to get the 3-D performance benefits, but you'll at least not get your machine rooted.
Re:useless suggestion (Score:5, Informative)
Re:useless suggestion (Score:5, Informative)
It is interesting that when someone holds back the disclosure of a vulnerability in Microsoft software they are praised for practicing "responsible disclosure", but when these Rapid7 people do the same they are accused of foaming at the mouth needlessly since a fixed driver is allegedly already released.
Re: (Score:3, Insightful)
The one "acceleration" that the X.org 2d desktops use is mostly render (for doing font AA, etc). But the X.org 2d drivers can provide that without using kernel drivers.
The propietary module provides you a alternative and propietary 2d driver, but's its possible to use the nv one, which was written also by nvidia i think. I don't know if it
Re:useless suggestion (Score:5, Insightful)
Re: (Score:3, Funny)
One more reason to use OpenGraphics.org card (Score:5, Informative)
Unless there is a wealthy individual / corporation out there who is willing to invest in order to manufacture this card earlier. The FOSS-friendly card will surely have a big appeal in Linux circles.
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
It's only sort of a remote exploit (Score:3, Interesting)
So we have three possible routes to privilege escalation. One, the person already has shell access. This is rather rare these days. In any case, you can restrict access to X to only those people you trust or can hold accountable. Two, a remote X client. Who allows remote X connections these days? Require shell access with X connection tunneling through SSH and see #1, above.
Three
Re: (Score:3, Informative)
Then perhaps you can explain why this isn't a working javascript exploit proof of concept:
(Taken from a post further down this very page)
http://nvidia.com/content/license/location_0605.as p?url=';a='a';i=18;while(i--)a%2B=a;location=a;// [nvidia.com]
I mean... if the overflow is that easy, wouldn't someone adept at hitting the right targets in memory be able to do a lot worse with nothing more than javascript?
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
I don't think you understand how this exploit works:
This exploit cannot be remotely executed. It requires a user to be logged into their account on the machine they want to infect. In other words, for those of us with linux workstations (only one user account), this exploit doesn't affect us at all.
The only type of machine this exploit targets are machines with multiple untrusted user accounts. I can't imagine why someone wo
Matrox source driver (mga) for G550 does 3D (Score:3, Informative)
Well since you mention Matrox, get their G550 which has both GL support *and* open drivers.
The Matrox G550 PCIe card works perfectly with the pure open-source mga driver that comes as standard with all recent kernels. I've been using it in my Dell 2800 server, and its record of reliability is 100%.
Matrox even boldly proclaim their Linux source driver support on the box. That's quite unusual!
The
Re: (Score:3, Informative)
And dual-head.
Quite useless. (Score:2, Insightful)
Also the ones without openGL performance. Remind me why I bought a high-performance 3D card again.
Re:useless suggestion (Score:5, Insightful)
As far as I'm concerned, if you're a potential customer, a company damn well ought to listen to you if they want to sell their products. Open-source drivers are a feature that a lot of users want, whether to use cards on other architectures, to fix bugs sooner, to improve their performance, to audit them for use in security-sensitive deployments, etc.
Lots of users would *LOVE* to punish NVidia for not responding to their desire for open-source drivers, but they really can't... there's no good alternative. ATI drivers are closed-source as well, and that's the only other big player in 3D graphics cards. Now Intel has come out with actual real-live open-source drivers for their 3D graphics cards, and there's been a chorus of folks planning to switch over to them (even though they're rather underpowered compared to the NVidia cards).
NVidia may make pretty good drivers, but I bet they could be made a whole lot better and more versatile by open-sourcing them. I've encountered 4 or 5 NVidia driver bugs on my AMD64 box, and have NEVER found any bug in any other non-experimental open-source Linux device driver.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
A tale of two drivers: Closed and Open (Score:3, Insightful)
I've always doubted the 'trade secrets' argument (Score:3, Insightful)
I mean, it's not like anyone out there actually has a disassembler or anything. If there was anything worth digging for in their binary drivers, someone would have disassembled that bit and posted it as code already.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Allowed? (Score:5, Insightful)
This will no doubt fuel the debate about whether binary blob drivers should be allowed in Linux.
Of course they should be allowed. How can that even be prevented? The more important question is what can be done to either provide more secure replacements or make sure binaries can be functional without having to be trusted by the OS.
Re:Allowed? (Score:4, Insightful)
The Nvidia blob is perhaps a special case, since it's really a windows driver with a GPLed wrapper, so the Linux community tends to turn a blind eye, as long as the driver isn't distributed alongside the kernel. Anyone trying to write a blob driver for Linux, from scratch, would be on shaky ground. Even Linus has said that if you wrote your driver with Linux in mind, it's a derivative work.
This is a grey area and there's not a lot of case law to decide exactly what is, and isn't, a derivative work in software, so a debate does occasionally flare up, most recently with the Kororaa livecd.
Re:Allowed? (Score:4, Informative)
The argument goes that a driver developed specifically for Linux is a derived work of the Linux kernel, and thus is subject to the conditions of the GPL. IANAL, but it seems to be a fairly sound argument. There is an explicit waiver for the standard user-space interfaces (so applications are not automatically considered derivative works), but no such waiver exists for the Linux-specific kernel interfaces. nVidia gets around this by (a) using an open-source wrapper, so their real driver doesn't use any of the Linux kernel interfaces directly, and (b) using the same driver code on Linux and Windows (so the driver isn't entirely dependent on Linux).
This has nothing to do with whether there is aggregation or dynamic linking, and everything to with whether the module is dependent on the GPL'd kernel API.
Re: (Score:3, Insightful)
Adding functionality has nothing to do with copyright law. If you don't believe me, add some binary-only functionality to gcc or emacs and see how long it takes for Eben Moglen to get on your phone.
"besides there's too many other backdoor ways of getting round it"
Well you can shift your blob down into firmware or up into userspace. I think the kernel devs would be hap
Re: (Score:2)
We're talking about a graphics driver here. It pretty much has to execute in kernel mode. you know, where you can do anything you want on the system? Sure, we could have a userspace graphics driver, but it would still need a kernel mode driver stub and it would be substantially slower, which is not really an option for most people.
Re: (Score:3, Interesting)
We're talking about a graphics driver here. It pretty much has to execute in kernel mode. you know, where you can do anything you want on the system? Sure, we could have a userspace graphics driver, but it would still need a kernel mode driver stub and it would be substantially slower, which is not really an option for most people.
With the current design of the Linux kernel + userspace, I agree, but I'm unconvinced that that has to be the case. I see inherent stumbling blocks to untrusted video drivers,
None of you dickheads know what you are on about.. (Score:3, Interesting)
And for the record, X11 drivers run in userland, as root so they can access hardware ports directly. There's no real reason for them to require root, except that allowing any process to access hardware ports will undermine the security and stability of the syst
Re: (Score:2)
Why? Once VRAM and memory-mapped registered are brought into the processes' address space, why shouldn't most of the code run in user mode and, say, read IRQs from some
Re: (Score:2)
Wait for Hurd, because the micro-kernel approach makes sure that drivers run in isolation?
Yes, I know that this is put in a flambaitic manner, but is there any better reason to make sure your kernel consists of as little as possible? Even if the server that handles the device crashes, the rest of your system won't be compromised. The per
To Theo de Raadt (Score:5, Insightful)
Re: (Score:2, Informative)
You beat me to it. This is now 2 (or 3?) exploits thanks to binary blobs that OpenBSD is immune to.
Re: (Score:2)
Re: (Score:2, Insightful)
OpenBSD had a root level exploit in 2000.
Many applications that run on OpenBSD have had exploits in them including SSH.
Seems kind of harsh to bent all selfrightous over one exploit. I hope nVidia patches it soon.
Re: (Score:3, Insightful)
And that's the problem. The fact that people have been complaining about this for two years, and havn't even put together a binary patch for it, suggests to me that the "we don't have source" argument, although valid, is just an excuse for making yourself a victim. I wish I had heard about this two years ago because I would have made a binary patch and made sure everyone knew they had to install it. But I guess t
Re: (Score:3, Insightful)
Open vs. Closed yet again... (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:2)
Besides, the consumer wins when nVidia/ATI optimizes their drivers, even if their optimizations may be game specific, or is some sort of shortcut. In the end, the games run faster.
Re: (Score:2)
Open source graphics drivers are a potential goldmine for patent lawsuits. nVidia has accused ATi of driver reverse engineering in the past, so its not going to happen.
Personally I don't care - as long as they work.
Re: (Score:2)
In effect, given the costs of production, it would be a lot cheaper for both ATI and NVidia to make a single GPU, and use binary drivers to enable/disable additional pipelines, texture processing units, etc, than it would be to actually make a series of different GPUs that have those capabilities. It wou
Re: (Score:3, Interesting)
How serious, really? (Score:2)
Re: (Score:3, Insightful)
Missing out. (Score:5, Insightful)
Re: (Score:2)
I somehow doubt it (Score:5, Informative)
Also, they just can't. They have licensed code in their drivers that can't be opened up. Want real OpenGL? Well than you takes what you gets. OpenGL isn't free to hardware developers. It's $25,000 to $100,000, plus royalties for distribution and it does come with terms and conditions on it's release. There's also licenses on patented code like S3TC in there.
Now if the Linux community wanted to develop their own graphics API that was unencumbered, then maybe you could convince the companies to open their code up. However if you want a full featured GL driver, you are going to need to deal with closed source, at least form nVidia and ATi since they've both already signed licenses on it.
Re: (Score:3, Informative)
Check the SGI OpenGL FAQ [sgi.com] for more information. It's ambiguous as to whether an open source driver project would require the fee; however, since the fees are associated closely with closed-source development, I'm guessing that there would be no additiona
This is a relatively minor problem (Score:5, Insightful)
What we need is a graphics vendor who publishes full specs for their graphics chips! If nVidia won't do it, find someone who will.
Intel Open Source Graphics Driver (Score:2, Interesting)
Re: (Score:3, Insightful)
Re: (Score:2)
HW makers should produce multiple drivers (Score:5, Interesting)
A high-performance, possibly proprietary, specification that gives them a definate edge over their competitors. If they want to ship binary-only drivers that's fine.
A possibly-lesser-performance specification that does "the basics" - everything a typical device of its type can do. This specification should be public, preferably with open-source drivers. Even without drivers, those who need to can write drivers from the specification. For a high-end video card, this should be everything that a low- or medium-end card could do. For an all-in-one printer, this should include basic full-color printing at "typical for its technology" resolutions, basic full-color scanning at "typical for its technology" resolutions, and b&w and color faxing. For a high-end sound card, this should include at least 2-channel sound. For a communications device, it should include all internationally-accepted standards that the device supports, but need not include the most efficient or highest-performance embodiment of those standards.
Most important is full disclosure:
Any device that doesn't provide a full, published specification of "everything" must disclose the limits of the published specifications, so buyers will know exactly what they are buying: a device that, should problems be found with the drivers, or when used with operating systems without supported drivers, is limited to a specified downgraded functionality.
Re: (Score:2)
Can't get worked up (Score:4, Insightful)
Analyzing this, I think the reason is because the NVidia and ATI drivers are a PITA everywhere. By installing the drivers, you agree to destablize your system in exchange for the most incredible 3D (and 2D to a certain degree) performance. When Something Bad Happens(TM), you just sort of take it as coming with the territory.
It's sort of like hooking Nitro up to your car. Sure, your engine is more powerful than ever. But are you really all that surprised when you bust a valve, crack a ring, or do some other form of damage to your hotrod?
It would be nice if OSS drivers could be created. But it's probably not going to happen. NVidia won't open their drivers (ATI, doubly so) and the OSS community doesn't have enough info to recreate them. Thus I think the best bet is the Open Graphics Project [duskglow.com]. If they produce a viable 3D card alternative, you'll finally be able to chose between a stable (but slower) 3D card, or a high-performance, hotrod 3D Card. Take your pick to meet your needs.
Oh, and keep a firewall in front of your machine and the internet. Pipe all your X communications over SSH. Just good safety sense.
Re: (Score:2)
Re: (Score:2)
It ain't too serious. (Score:5, Insightful)
How many people use the nVidia cards in their servers? None, I guess. nVidia, and most 3D-cards is used on personal systems, with one user, which is usually root. If that user can use a root exploit to become root - so what! Remember that you have to be able to control the X11 display server to take advantage of this, which means you *have* to be logged in locally or be root.
Whilst I agree with the principle, I don't think this bug will have *any* impact, as most home boxes have no accounts accessible from the internet, that is able to run X11. If they have, they probably have bigger problems. Same goes for people running untrusted code that can execute this: it could as well provide a shell, or whatever. Yet, the problem is then *untrusted* code. A person that runs untrusted code can probably be coerced into running that as root as well.
So my guess: zero impact!
Re: (Score:2)
Re: (Score:2)
"This bug can be exploited both locally or remotely (via a remote X client or an X client which visits a malicious web page)."
Re: (Score:3, Insightful)
Because an exploit for *any* software you run has full access to your system? If you run as root, the cracker merely needs to alter the execution of your program and they're in with full priviledges.
If you don't run as root, they have a far smaller selection of programs (basically daemons or drivers) that will potentially get them remo
So... (Score:5, Insightful)
Re:So... (Score:5, Informative)
The problem is that all users of Nvidia graphics cards are helpless to make their machines safe because Nvidia has control over the source code. If Nvidia says 'Screw you' or goes bankrupt, then their users are screwed. Had they GPLed their driver, then someone else could have fixed it.
And that's exactly what's happened in this case.
If you read the TFA, you'll see that NVidia has known about this bug for TWO GODDAMN YEARS already and NOT fixed it. Surely that's one big 'SCREW YOU' to the Linux, Solaris and BSD communities right there.
Fixed weeks ago (Score:5, Informative)
1600x1200 w/ DVI in the 'nv' driver, please? (Score:2, Informative)
https://bugs.freedesktop.org/show_bug.cgi?id=3654 [freedesktop.org]
"The "nv" driver currently can't change the BIOS-programmed display timings. Unf
Oh, give me a f*ckin' break! (Score:2)
neighbors watch out (Score:5, Funny)
Oh, I see, first I have to break into his house
Couldn't use nVidia's driver anyway. (Score:2)
It wouldn't render fonts correctly for me unless I turned off the render acceleration, and even then fonts wouldn't render under WINE.
Much as I'd like to have the acceleration features of the card, I can't until nVidia figures out how to get their drivers relatively bug-free with FreeType and Xorg R7. That might take a while, so I'll just have to bide my time with the stock "nv" driver. Google Earth will be incredibly slow for me until that time:
Fixed in 1.0-9xxx driver releases (Score:2, Informative)
http://www.nzone.com/object/nzone_downloads_rel70b etadriver.html [nzone.com]
as well as the 1.0-9626 QuadroPlex driver: .0-9626.html [nvidia.com]
http://www.nvidia.com/object/linux_display_ia32_1. 0-9626.html [nvidia.com]
http://www.nvidia.com/object/linux_display_amd64_1
Thanks
Possible remote exploit vector (Score:5, Insightful)
OS nv driver does not support dual-head (Score:3, Informative)
out of the OS nv driver; the nVidia
closed-source drivers work for dual
head workstations.
As has been mentioned, why get an nVidia
card for your server? And this may be a
moot point for single-user workstations.
But do not assume that the nv driver is
a panacea.
A Free/Open driver for nVidia is being developed (Score:3, Informative)
http://nouveau.freedesktop.org/wiki/ [freedesktop.org]
http://wiki.x.org/wiki/nv [x.org]
nVidia Programmers (Score:4, Funny)
The root of this problem is 'C'. The nVidia programmers have way too much power. Buffer overruns, string comparisons, memory access, pointer arithmetic. These features need to be banned from modern computing.
Just last week over prune juice, I was telling Linus, Theo, and Dave Cutler why they should only allow C#/Java/Python based video drivers in their kernels.
Enjoy,
Local escalation (Score:3, Insightful)
If you follow best practices, you'll probably end up with a system where any vulnerability only leads to access as a user. But when there are local root exploits available, you can escalate that user access to root access and hide your rootkits there.
So with this Nvidia bug, the real risk is that another service gets compromised and the attacker then uses this exploit to get root. Once they have root, they can install rootkits, etc.
The beta drivers seem ok (Score:5, Informative)
I have just installed NVIDIA-Linux-x86-1.0-9625 and it seems ok so far. I've visited a few of the troublesome links with firefox 1.5.0.7 and it's not crashed X yet. I was using NVIDIA-Linux-x86-1.0-8762 before the update, and several times I've had X crap out on me. I don't believe I was r00ted though, after reading about the glyph problems. It can also be triggered by a long "get" request, or long lines of text in a form field. I was using TinyMCE [moxiecode.com] when it first happened to me. Here's a test url that supposedly crashes X from firefox - http://comptune.com/calc.php?methos=POST&base1=10
I didn't check this before the update though, so it may not be conclusive.
My main complaint about the whole issue is that I only found out because it was posted here. I don't have time to go checking for updates and exploits for all my different drivers and software, that's why yum runs from cron every night. It would have been nice if somebody (nVidia) had posted that a new version was available that fixed potential security holes, or even had a version checker built in to notify me of an update.
Re:on the bright side... (Score:5, Informative)
Re: (Score:2)
http://www.nvidia.com/object/linux_display_ia32_1
And the first comment in the linked KernelTrap reports that this problem was fixed. I'm not sure if that is true though as I haven't verified it myself.
Re: (Score:2)
For as long as I have lived, I have seen some unusual mottoes, but this one takes the cake.
Re: (Score:2)
Re: (Score:2)
The Linux community gains more from individual freedom than from dogmatic declarations and limitations...
Re: (Score:2)
BTW, "binary BLOB" makes about as much sense as "ATM machine".
Re: (Score:3, Informative)
"This bug can be exploited both locally or remotely (via a remote X client or an X client which visits a malicious web page)."
That part wasn't in the
Re: (Score:3, Informative)
OK, I read a bit further, looks like you just need to create a malformed glyph in an embedded font. Not at all difficult to do with Java, Flash, or just plain HTML (or so I've heard, never seen an embedded HTML font in the wild). Damnit. Back to eLin
This is an obvious fraud (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Free software users need to unite and say NO to binary blobs! Lets kick this crud out of our operating systems!
In the interests of full disclosure, don't forget to mention that you're saying NO to a lot of capability with your principled stand. You already understand this, I'm sure, and what you're losing (i.e., accelerated 3d) you obviously can do without. But for some, that's not negotiable.
I'd be curious to understand what you envision as the way forward from this. If we successfully "kick this crud ou
Re: (Score:2)
Trade in your video card for a second-hand AGP Radeon 9x00. You get fast mostly working 3D, open source drivers, and the binary lock-in nazis don't get a single penny of your money.