The Year of Linux Security
Posted Feb 2, 2021, 5:17 PM UTC
12516
For those too lazy to fire up cve.mitre.org, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3347
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling, allowing local users to execute code in the kernel
3
Could you explain the vulnerability in simpler terms? I don't have much knowledge of cybersecurity and the terms used in describing the vulnerability.
2
Ok, so Linux kernel is written in C, which is a language with manual memory management. While it gives the programmer a lot of room for optimizations, it also creates a lot of possibilities for making mistakes called "undefined behavior". Sometimes those mistakes manifest directly (e.g. the program crashes), but sometimes they don't, and (perhaps counterintuitively) that's the scarier type. Sometimes undefined behavior creates situations in which it is possible for an attacker to provide the program some input which overrides the program code itself and then gets executed. And in fact that's exactly what's happening here -- part of memory gets marked as "free" (so, unused) but a malicious user can still write data there, which then, if it gets allocated by the program again, might get executed.
Now, this might seem like it's not that bad, right? A program user just executes code that's a bit different from what was intended. However, in this case the exploit has terrible consequences: now every user on the system can, with some luck, execute code IN THE KERNEL CONTEXT. This means that they can do literally everything with the system -- get a root shell, insert their own drivers, spy on other users.
3
Okay, so if I understand everything correctly, the exploit allows a local user(ie they're supposed to be physically present at the system) to insert code in free memory, and when this free memory is allocated, the code gets executed at the root level, allowing a malicious local user root control over the system?
1
ie they're supposed to be physically present at the system
Nope, by local user it is meant that you can execute code on the system. E.g. if an attacker cracks your ssh password or finds a remote code execution vulnerability in your browser, they can potentially exploit this.
to insert code in free memory
Kinda. In particular, this exploit allows the user to insert data in a portion of kernel memory space that still has a pointer to it. If this space is allocated again and the pointer is misused in just the right way, you can get the kernel to execute arbitrary code.
at the root level
No, it's (marginally) worse than root. It's in RING0. (but technically a root user should be able to do the same in most configurations).
3
Sudo, or superuser do, is a command used by standard users to run any other command with the same privileges as root, which standard users are otherwise unable to do.
Usually, distros have sudo configured in a way that only lets users from a trusted group have root access. Let's think of sudo as a bouncer, and groups as state ID. If you don't have a valid ID, sudo is gonna turn you away and jot some stuff down in a notebook for the authorities (aka root) to review later.
Enter this exploit, which lets you say a secret code to the bouncer so they look the other way. It's a simple hail Sithis, get in, steal some sweetrolls, then get out.
edit: Sleepy brain me didn't click the cve link because I thought it was the sudo cve. Don't pull a sleepy brain like I did.
0
No, this is not the sudo exploit (which was https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3156). This is a new exploit in the Linux kernel itself.
2
Huh, I'll take this as my cue to go to bed.
3
I just replaced it with doas
1
Install linux they said it's more secure they said.
1
oh yeah pacman -Syu is really complicated
Imagine running Arch on hundreds of servers
Also, this is a joke; obviously, updating servers must be a no-brainer process, but I just find it kind of funny that two critical vulnerabilities come in a timespan of like 2 weeks.
only heard about one sorry
CVE-2021-3156 (buffer overflow in sudo) and CVE-2021-3347 (use-after-free in Linux)