EDGE 2015 is starting in

Find out more EDGE 2015
Menu
Linux vendors rush to patch privilege escalation flaw after root exploits emerge

Linux vendors rush to patch privilege escalation flaw after root exploits emerge

A privilege escalation vulnerability in the Linux kernel allows attackers to gain root access

Linux vendors are rushing to patch a privilege escalation vulnerability in the Linux kernel that can be exploited by local attackers to gain root access on the system.

The vulnerability, which is identified as CVE-2012-0056, was discovered by Jüri Aedla and is caused by a failure of the Linux kernel to properly restrict access to the "/proc/<pid>/mem" file.

According to Carsten Eiram, the chief security specialist at vulnerability research firm Secunia, the flaw was introduced in the Linux kernel code in March 2011 and affects versions 2.6.39 and above. "Any Linux distributions providing these kernel versions should be vulnerable," Eiram said.

Linus Torvalds submitted a patch on the official Linux kernel repository on Jan. 17, but before Linux vendors had a chance to apply it for their distributions, proof-of-concept exploit code already appeared online.

One of the most complete exploits for CVE-2012-0056 is called mempodipper and was written by security researcher and programmer Jason A. Donenfeld. Mempodipper works around various factors that could limit the impact of this vulnerability in Linux distributions like Fedora or Gentoo.

Ubuntu and Red Hat have already released patches to address this vulnerability and other vendors are expected to follow in their footsteps soon. "We recommend that system administrators apply these patches," Eiram said.

Donenfeld published a detailed article about how the vulnerability can be exploited on his blog on Sunday, which served as inspiration for other exploit writers. One of them was Jay Freeman, better known online as saurik, the creator of the Cydia app store for jailbroken iPhones, iPads and other iOS devices.

Freeman used Donenfeld's instructions to create a local root exploit for Android 4.0 (Ice Cream Sandwich), which he dubbed mempodroid. Several members of the XDA Developers community already confirmed that the exploit works, but advised users who are not familiar with adb shell to wait for a simpler implementation.

Samsung Galaxy Nexus and ASUS Transformer Prime are the only devices that run Android 4.0 at this time, and the Galaxy Nexus has built-in rooting capabilities. However, mempodroid might open the door for rooting other devices that will eventually get updated to Ice Cream Sandwich.

"While Android itself is open, many of the devices that use it are not, and the Transformer Prime has a locked bootloader, making exploits such as this required to install custom software," Freeman said in the exploit's release notes.

EDGE 2015:: For all the latest on EDGE 2015 including the keynote speakers visit the EDGE mini-site now

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Upcoming

Slideshows

In Pictures: 7 things we hate about Twitter

In Pictures: 7 things we hate about Twitter

You probably either love Twitter for its quirkiness and brevity or see it as a pointless waste of time. After nearly a decade on the social scene, Twitter still needs to improve its user experience and fill in notable gaps in the service. These seven problems are long overdue for a fix.

In Pictures: 7 things we hate about Twitter
IN PICTURES: EDGE 2015 - Sponsor Briefing

IN PICTURES: EDGE 2015 - Sponsor Briefing

With EDGE 2015 rapidly approaching, ARN and Reseller News NZ held a Sponsors Briefing where ARN publisher and president, Susan Searle, and Events Manager, Alexandra West, ran through the considerable logistics in detail. Attendees then enjoyed some splendid canapes and drinks. EDGE is designed to bring the A/NZ channel together in a collaborative and educational environment. Themed around channel channel leadership, EDGE will be held at the Sheraton Mirage, Port Douglas, July 20-23. Photos by MIKE GEE.

IN PICTURES: EDGE 2015 - Sponsor Briefing
In Pictures: Robots that cook, clean, sing and dance

In Pictures: Robots that cook, clean, sing and dance

Cooking, learning language and doing the laundry are a few of the human skills demonstrated by.real humanoid bots featured in the National Geographic movie Robots.

In Pictures: Robots that cook, clean, sing and dance

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments