Linux bug imperils tens of millions of PCs, servers, and Android phones
http://arstechnica.com/security/2016/01/linux-bug-imperils-tens-of-millions-of-pcs-servers-and-android-phones/
For almost three years, millions of servers and smaller devices
running Linux have been vulnerable to attacks that allow an
unprivileged app or user to gain nearly unfettered root access.
Major Linux distributors are expected to fix the privilege
escalation bug this week, but the difficulty of releasing
updates for Android handsets and embedded devices means many
people may remain susceptible for months or years. The flaw,
which was introduced into the Linux kernel in version 3.8
released in early 2013, resides in the OS keyring. The facility
allows apps to store encryption keys, authentication tokens, and
other sensitive security data inside the kernel while remaining
in a form that can't be accessed by other apps. According to a
blog post published Tuesday, researchers from security firm
Perception Point discovered and privately reported the bug to
Linux kernel maintainers. To demonstrate the risk the bug posed,
the researchers also developed a proof-of-concept exploit that
replaces a keyring object stored in memory with code that's
executed by the kernel.
- - -
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently
doing so -- my opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
