3

There is a security hole CVE-2014-019 in the Linux kernel since 2.6.31-rc3 which

allows local users to cause a denial of service (memory corruption and system crash) or gain privileges

How serious would this be on my server where I allowed only some trusted friends full SSH access?

As far as I understand, an attacker would have to get access to just one account with low privileges somehow (even in a chroot jail for SSH environment?) and then he could gain root access with this exploit?

5

Let's break this down, first of all have a look at the CVSS score:

 (AV:L/AC:M/Au:N/C:C/I:C/A:C)

So:

  • Access Vector: Local
  • Access complexity: Medium
  • Authentication: None
  • Confidentiality: Complete
  • Integrity: Complete
  • Availability: Complete

The vulnerability can result in privilege escalation, meaning a user with few privileges, might gain access to the root account. However the current exploit, which is readily available only results in a Denial of Service. If someone is able to port this exploit, (maybe it already has but is not public yet) . Then there is a risk that someone could have used it. On the other hand, you should never allow people onto your machine if you don't trust them.So if you say that you trust your friends, then this shouldn't be an issue,but this does NOT mean you shouldn't patch the vulnerability!

|improve this answer|||||
  • And on another machine, where we use a chroot jail for customers? Could they break out this way? – rubo77 May 14 '14 at 11:36
  • AV:L is Local not Low (here redundant with the text description "local users ...") – dave_thompson_085 May 14 '14 at 16:54
  • CVSS Scores are getting outdated. As Heartbleed only has a 4~5 ish score. blog.risk.io/2014/04/heartbleed-is-not-a-big-deal – Stolas Jun 11 '14 at 8:49
  • And there are no alternatives at the moment to represent risk in a numeric way. – Lucas Kauffman Jun 11 '14 at 11:23
  • @Stolas: does this mean, there are other vulnerabilities out, that are as dangerous as Heartbleed, just not in the press so much? and are all of those fixed? – rubo77 Jun 11 '14 at 16:12
2
+50

Yes, CVE-2014-0196 can be used for privilege escalation, because it allows overwriting buffers in the kernel outside the one allocated to your pty.

This means that a non-privileged user could use it to become root. It's not limited to the friends that you've allowed access, either. If an attacker were able to compromise a service running on your system (a webserver, for example), they'd be able to escalate to root as well. Even just by finding a vulnerable webapp (PHP script, python app, etc.) that allows execution of local commands, they could escalate to root.

There's a PoC for specific kernel versions here: http://bugfuzz.com/stuff/cve-2014-0196-md.c, so it's definitely doable, though the PoC given may not generalize to all affected versions of the kernel.

Chroots would have no impact on this exploit, as it requires only being able to make some syscalls, and chroots are about limiting access to the filesystem. An attacker would need to either compile their exploit locally or be able to download it, but it could even be transferred over an SSH or similar connection, so unless there's nowhere mounted writable and executable to the user, the chroot offers no protection at all.

|improve this answer|||||
  • Are you saying, this Exploit was never used to hack into a machine yet? And It doesn't have to be fixed as fast as the Heartbleed exploit? – rubo77 Jun 11 '14 at 16:14
  • Definitely not saying that. It's clearly been used at least for developing the PoC, and what might be done by others is unknown. This is clearly a high severity issue, but since it requires local access, is not critical. It's been publicly known for a month now, you should already have patched by this point. – David Jun 11 '14 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.