<<< Date Index >>>     <<< Thread Index >>>

R: Linux kernel source archive vulnerable



Hi Hadmut, by the way cross post is bad so I'll reply only in bugtraq. The ones 
you 
report are not, IMHO, vulnerability in Linux Kernel source code archive.
May be you want to administer your severs ina secure fashoned way involving a 
proper ownership access to /user/src and /lib/modules path ensuring that 
regular 
user belonging to special group can write into it.
If "compile it's usually done as root" is not a kernel vulnerability but a non 
secure 
aware sysadmin behaviour. 
Consider "--no-same-owner" or "--owner" tar flags in order to customize 
extracted
file ownership.
 
Anyway just few considerations:
1) a server exposed to Interne, is NOT supposed to have compiler installed in 
it. 
You may use a compile machine to build custom kernel and installing to your 
production 
environment or you may want to use your ditribution kernel package.
So you don't need to have /usr/src/linux at all.
2) a good sysadmin is aware that /usr/src is NOT supposed to be world writable
 
Anyway... I don't think this is a "severe vulnerability in the Linux kernel 
source code
archives". IMHO, of course
 
My 0,02EUR
 
sp0nge


________________________________

Da: Hadmut Danisch [mailto:hadmut@xxxxxxxxxx]
Inviato: gio 07/09/2006 20.23
A: full-disclosure@xxxxxxxxxxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx
Oggetto: Linux kernel source archive vulnerable



Hi,

there's a severe vulnerability in the Linux kernel source code archives:


The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.

When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.

This opens the door for at least three kinds of attacks:


1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
   world writable directories at a well defined place, perfect to hide
   any malware, bot, rootkit,...

2. Any user or intruder can modify the kernel source and thus compromise
   the kernel to be compiled.

3. any user or intruder could modify the build or installation
   system/Makefiles in order to have any kind of malware executed by
   root the next time a kernel is built or installed, or any other
   kernel module making use of the kernel tree.


Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.

regards
Hadmut

--
The information transmitted is intended for the person or entity to which it is 
addressed and may contain confidential and/or privileged material. Any review, 
retransmission, dissemination or other use of, or taking of any action in 
reliance upon, this information by persons or entities other than the intended 
recipient is prohibited. If you received this in error, please contact the 
sender and delete the material from any computer.