New Linux exploit published

At the Full Disclosure mailing list, a demonstration of a new weak point in the Linux kernel has been published. It allows registered users to gain root rights to the system. It uses what is called a "race condition" - the lack of protection against conflicting access to a resource - in the /proc filesystem. According to the Internet Storm Center, the hole affects all versions of the 2.6 kernel. While the demonstration itself requires support for the outdated binary format a.out, the hole can also be exploited even if CONFIG_BINFMT_AOUT is not set. The security extension SELinux used in Red Hat enterprise Linux 4 apparently also stops the exploit.

Such local exploits are often used to gain access to administrator rights on systems used by multiple users. Less than a week ago, unidentified hackers exploited a similar hole in the Linux kernel (which has since been patched) to compromise a server used in the Debian project. Before this 0day exploit was published, heise Security had received indications that a large number of other such local-root exploits that attack previously unknown weak points are also in circulation. The discovery of this 0day exploit is good evidence that these indications were true.

In response to the discovery of this new weak point, the "ugly /proc hole", Linux Torvalds has published updated kernel versions 2.6.17.5 and 2.6.16.25. A following minor update to 2.6.17.6 respectively 2.6.16.26 relaxes the introduced restrictions a bit.

Also see:

• Linux kernel 0day - dynamite inside, don't burn your fingers, report at Full Disclsore
• ChangeLog on kernel 2.6.17.5
• ChangeLog on Kernel 2.6.16.25

(ehe)