Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There is a security hole CVE-2014-019 in the Linux kernel since 2.6.31-rc3 which
allows local users to cause a denial of service (memory corruption and system crash) or gain privileges
How serious would this be on my server where I allowed only some trusted friends full SSH access?
As far as I understand, an attacker would have to get access to just one account with low privileges somehow (even in a chroot jail for SSH environment?) and then he could gain root access with this exploit?
Let's break this down, first of all have a look at the CVSS score:
(AV:L/AC:M/Au:N/C:C/I:C/A:C)
So:
The vulnerability can result in privilege escalation, meaning a user with few privileges, might gain access to the root account. However the current exploit, which is readily available only results in a Denial of Service. If someone is able to port this exploit, (maybe it already has but is not public yet) . Then there is a risk that someone could have used it. On the other hand, you should never allow people onto your machine if you don't trust them.So if you say that you trust your friends, then this shouldn't be an issue,but this does NOT mean you shouldn't patch the vulnerability!
Yes, CVE-2014-0196 can be used for privilege escalation, because it allows overwriting buffers in the kernel outside the one allocated to your pty.
This means that a non-privileged user could use it to become root. It's not limited to the friends that you've allowed access, either. If an attacker were able to compromise a service running on your system (a webserver, for example), they'd be able to escalate to root as well. Even just by finding a vulnerable webapp (PHP script, python app, etc.) that allows execution of local commands, they could escalate to root.
There's a PoC for specific kernel versions here: http://bugfuzz.com/stuff/cve-2014-0196-md.c, so it's definitely doable, though the PoC given may not generalize to all affected versions of the kernel.
Chroots would have no impact on this exploit, as it requires only being able to make some syscalls, and chroots are about limiting access to the filesystem. An attacker would need to either compile their exploit locally or be able to download it, but it could even be transferred over an SSH or similar connection, so unless there's nowhere mounted writable and executable to the user, the chroot offers no protection at all.
