Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Russia Today reports (20 January 2016) that there is a new zero-day exploit that has been discovered affecting Linux and all Linux-based OSes for computers and phones.

What is the deal; how does it affect Ubuntu; and when can we expect security updates that will close this security hole?

share|improve this question
    
When ? as soon as possible, cannot give you specific date or time – edward torvalds Jan 20 at 11:02
    
which kernel is vulnerable and what mitigation to address the vulnerability? – Single Jan 20 at 16:44
    

It has been patched already.

Quoting the article:

[...] "Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges," reads today's Ubuntu Security Notice USN-2872-1 for Ubuntu 15.10. [...]

and

[...] patches are now available for the Ubuntu 15.10 (Wily Werewolf), Ubuntu 15.04 (Vivid Vervet), and Ubuntu 14.04 LTS (Trusty Tahr) distributions. [...]

and

[...] you are urged to upgrade the kernel packages to linux-image-4.2.0-25 (4.2.0-25.30) for Ubuntu 15.10 (Wily Werewolf), linux-image-4.2.0-1020-raspi2 4.2.0-1020.27 for Ubuntu 15.10 (Raspberry Pi 2), linux-image-3.19.0-47 (3.19.0-47.53) for Ubuntu 15.04 (Vivid Vervet), and linux-image-3.13.0-76 (3.13.0-76.120) for Ubuntu 14.04 LTS (Trusty Tahr). [...]

So users of the patched releases (15.10 / 15.04 / 14.04, and according to Canonical also 12.04) may (and should) upgrade right away by running:

sudo apt-get update && sudo apt-get dist-upgrade

and rebooting the computer afterwards.

share|improve this answer
    
Thanks for your reply! We will pass along the info ASAP! – IWPCHI Jan 20 at 11:38
13  
@IWPCHI If you found this answer useful remember that you may accept it as well. – kos Jan 20 at 12:18
1  
@IWPCHI Don't thank Kos! ;-) If this answer did help, just click the little grey under the number now turning it into beautiful green. If you do not like the answer, click on the little grey down-arrow below the 0, and if you really like the answer, click on the little grey ☑ and the little up-arrow... If you have any further questions, just ask another one! – Fabby Jan 21 at 22:03

Just complementing @kos's nice answer:

The Zero day exploit (CVE-2016-0728) was found by the researchers at Perception Point.

It was introduced in 3.8 Vanilla Kernel. So the Ubuntu releases using kernel versions 3.8 or later are vulnerable. As @kos already mentioned, on a supported release you can just upgrade the kernel to install the patch:

sudo apt-get update && sudo apt-get dist-upgrade

How to Check the Vulenerability (taken from here):

Install libkeyutils-dev:

sudo apt-get install libkeyutils-dev

Copy this C program from github, written by the Perception Point team to test the exploit.

Save the codes in a file e.g. test_2016_0728.c and compile:

gcc test_2016_0728.c -o test_2016_0728 -lkeyutils -Wall

Run the compiled program as normal user:

./test_2016_0728 -PP1

It would take some time, if your kernel is vulnerable after the completion of the program you will see that your privilege has been escalated i.e. you have become root.

share|improve this answer
    
Too bad I had upgraded already or I definetly would have tested this! – kos Jan 20 at 12:53
    
@kos ummm...bad for you :P – heemayl Jan 20 at 12:55
    
Did you manage to reproduce the exploit? I didn't find anyone who did so far. – Jakuje Jan 20 at 17:55
    
@Jakuje I upgraded my kernel before I came to read the perception point's article.. According to the article it is the way.. – heemayl Jan 20 at 17:58
    
@Jakuje I'm testing the exploit on my Pi right now, which is running an unpatched version of Raspbian Jessie. It's running, but not much seems to be happening. – user323419 Jan 20 at 20:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.