16

Russia Today reports (20 January 2016) that there is a new zero-day exploit that has been discovered affecting Linux and all Linux-based OSes for computers and phones.

What is the deal; how does it affect Ubuntu; and when can we expect security updates that will close this security hole?

35

It has been patched already.

Quoting the article:

[...] "Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges," reads today's Ubuntu Security Notice USN-2872-1 for Ubuntu 15.10. [...]

and

[...] patches are now available for the Ubuntu 15.10 (Wily Werewolf), Ubuntu 15.04 (Vivid Vervet), and Ubuntu 14.04 LTS (Trusty Tahr) distributions. [...]

and

[...] you are urged to upgrade the kernel packages to linux-image-4.2.0-25 (4.2.0-25.30) for Ubuntu 15.10 (Wily Werewolf), linux-image-4.2.0-1020-raspi2 4.2.0-1020.27 for Ubuntu 15.10 (Raspberry Pi 2), linux-image-3.19.0-47 (3.19.0-47.53) for Ubuntu 15.04 (Vivid Vervet), and linux-image-3.13.0-76 (3.13.0-76.120) for Ubuntu 14.04 LTS (Trusty Tahr). [...]

So users of the patched releases (15.10 / 15.04 / 14.04, and according to Canonical also 12.04) may (and should) upgrade right away by running:

sudo apt-get update && sudo apt-get dist-upgrade

and rebooting the computer afterwards.

  • Thanks for your reply! We will pass along the info ASAP! – IWPCHI Jan 20 '16 at 11:38
  • 13
    @IWPCHI If you found this answer useful remember that you may accept it as well. – kos Jan 20 '16 at 12:18
  • 1
    @IWPCHI Don't thank Kos! ;-) If this answer did help, just click the little grey under the number now turning it into beautiful green. If you do not like the answer, click on the little grey down-arrow below the 0, and if you really like the answer, click on the little grey ☑ and the little up-arrow... If you have any further questions, just ask another one! – Fabby Jan 21 '16 at 22:03
16

Just complementing @kos's nice answer:

The Zero day exploit (CVE-2016-0728) was found by the researchers at Perception Point.

It was introduced in 3.8 Vanilla Kernel. So the Ubuntu releases using kernel versions 3.8 or later are vulnerable. As @kos already mentioned, on a supported release you can just upgrade the kernel to install the patch:

sudo apt-get update && sudo apt-get dist-upgrade

How to Check the Vulenerability (taken from here):

Install libkeyutils-dev:

sudo apt-get install libkeyutils-dev

Copy this C program from github, written by the Perception Point team to test the exploit.

Save the codes in a file e.g. test_2016_0728.c and compile:

gcc test_2016_0728.c -o test_2016_0728 -lkeyutils -Wall

Run the compiled program as normal user:

./test_2016_0728 -PP1

It would take some time, if your kernel is vulnerable after the completion of the program you will see that your privilege has been escalated i.e. you have become root.

  • Too bad I had upgraded already or I definetly would have tested this! – kos Jan 20 '16 at 12:53
  • @kos ummm...bad for you :P – heemayl Jan 20 '16 at 12:55
  • Did you manage to reproduce the exploit? I didn't find anyone who did so far. – Jakuje Jan 20 '16 at 17:55
  • @Jakuje I upgraded my kernel before I came to read the perception point's article.. According to the article it is the way.. – heemayl Jan 20 '16 at 17:58
  • @Jakuje I'm testing the exploit on my Pi right now, which is running an unpatched version of Raspbian Jessie. It's running, but not much seems to be happening. – user323419 Jan 20 '16 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.