[Full-disclosure] Linux kernel source archive vulnerable



Hi,

there's a severe vulnerability in the Linux kernel source code archives:


The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.

When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.

This opens the door for at least three kinds of attacks:


1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
world writable directories at a well defined place, perfect to hide
any malware, bot, rootkit,...

2. Any user or intruder can modify the kernel source and thus compromise
the kernel to be compiled.

3. any user or intruder could modify the build or installation
system/Makefiles in order to have any kind of malware executed by
root the next time a kernel is built or installed, or any other
kernel module making use of the kernel tree.


Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.

regards
Hadmut

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • RE: [Full-disclosure] Linux kernel source archive vulnerable
    ... Linux kernel source archive vulnerable ... The Linux kernel is distributed as tar archives in the form of ... The information contained in this email and any attachments is ...
    (Full-Disclosure)
  • Re: 5-stable kernel hang during boot
    ... Check the archives to see if someone else did. ... >>The really interesting part is that after installing the new kernel, ... >>I can't boot from kernel.old or another backup of my custom kernel. ...
    (freebsd-stable)
  • 2.6.0-preX causes memory corruption
    ... this may be a Kernel issue. ... CVS and tar'ing them up) the archives get corrupt. ... could be dozen of reasons such as compiler used, ...
    (Linux-Kernel)
  • Linux kernel source archive vulnerable
    ... there's a severe vulnerability in the Linux kernel source code archives: ... The Linux kernel is distributed as tar archives in the form of ... world writable directories at a well defined place, ...
    (Bugtraq)
  • RE: mouse not working
    ... I have checked the archives, ... (It also suggested using psmouse module command, ... But when I reboot into RH EL 3 or even XP, ... For the last it is important to know which kernel you are running. ...
    (Fedora)