Two New Flaws Haunt Linux Kernel

A pair of new kernel vulnerabilities are threatening the security of systems running current versions of several Linux distributions. One of the flaws gives a remote attacker the ability to crash vulnerable systems and the other leads to root privileges for a local attacker.

A pair of new kernel vulnerabilities are threatening the security of systems running current versions of several Linux distributions. One of the flaws gives a remote attacker the ability to crash vulnerable systems and the other leads to root privileges for a local attacker.

The most serious of the new vulnerabilities is a remote denial-of-service bug in the Linux kernel related to the way that the system handles large packets. During the IPv4 defragmentation process, the Linux kernel fails to handle oversized packets correctly, which causes the system to crash. A remote attacker could exploit this vulnerability to crash systems running the vulnerable versions of Linux.

There is also another Linux kernel bug that gives a local user the ability to gain root privileges on an affected system. The problem is in the Ext4 file system, which in some instances doesn’t check permissions correctly, and could allow a local user to overwrite files on the system and gain root access to the machine.

Ubuntu has released a new package, fixing these flaws, and Red Hat also has released updates to its affected Fedora versions.

Suggested articles

Discussion

  • stanmorgan on

    <!-- /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {mso-style-parent:""; margin:0in; margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman";} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in; mso-header-margin:.5in; mso-footer-margin:.5in; mso-paper-source:7;} div.Section1 {page:Section1;} -->

    Linux users are arrogant when they state that Linux cannot be hacked. Recall the original hackers were users of UNIX, which Linux in the past was a subset of UNIX.

  • AnonymousCoward on

    @stanmorgan: I'm not aware of /any/ individual or publication that has /ever/ stated that *nix cannot be hacked. Only fool would make such a claim, or believe it, for that matter.

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.