SliTaz Forum
You are not logged in.
Pages: 1
... seems to be serious, affecting all kernels from 2.6.31-rc3 right up to the current stable kernel.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0196
http://www.heise.de/newsticker/meldung/Schwachstelle-im-Linux-Kernel-Admin-Rechte-fuer-alle-2187501.html
Offline
Not at serious as you think.
which allows local users
What you can take away from this is to NEVER allow parties that are not 100% trusted to have a local user on your system. Simple as that.
Offline
As someone on the Heise forum put it ...
"local" != "physical access"
... which means that not only the local user but any program running in user space can exploit this vulnerability of the kernel. Many People download stuff from the Internet and run it without much thinking. This happens all the time. In a properly configured Linux distribution (not Puppy!) they're still protected by the limited access rights of their user configuration. That's why CVE-2014-0196 is quite a dangerous vulnerability. According to the Heise Article it is already actively exploited by some Internet nasties.
Offline
@Darjeeling
I do realize that local doesn't mean physical access, but it is common Linux security knowledge that you shouldn't run applications as a privileged user. The only applications are those that are common user applications, such as web browsers, image editors, or entertainment applications. But even than, you can have issues, because people could exploit those very applications, althogh that has got nothing at all to do with the Linux kernel itself really.
However, if you're running a web server as root with public access and no firewall, then you're kind of asking for trouble as well. At least run it as a non-privileged user without shell access, such as www with /bin/false as shell.
Again, non-related to the Linux kernel. For this security issue to ever be a problem, you would need applications running as non-privileged to be exploited first, and then have them send the required data to the kernel. The likeliness of this happening is very low.
Don't get me wrong, this is a problem that needs to be adressed, and the SliTaz kernel needs patches for this hole, but for it to even happen you would either need someone to specifically target your version of software, find a non-plugged vuln., and then gain access through the running applications to the user account to inject said data and somehow gain privilege escalation. When the applications are spawned as childs owned by the user themselves, there shouldn't be any privilege escalation to do, but it may be possible through other exploits too.
Again, kind of unlikely and mostly related to application errors, rather than actual kernel issues.
Offline
Corruption crash is more like than 'code execution'. Code execution has become like '... and world peace' in Beauty Queen speeches - if you're not sure how bad it is, you throw that in to get it noticed. I know quite a few that says it allows code execution when in fact it never did.
While we're on the subject, please explain to me how you'd use a root run web server to write locally to pty devices with two processes/threads at the same time. Otherwise this is just another Chicken Little exploit in my book.
Offline
Pages: 1
[ Generated in 0.025 seconds, 7 queries executed - Memory usage: 1.54 MiB (Peak: 1.77 MiB) ]