Old Linux Kernel Bug Discovered

Alexander Popov, one of the winners of the 2016 Linux Foundation Training (LiFT) scholarship, has discovered a very old bug in the Linux kernel that can affect modern systems.

Popov wrote on a mailing list, “This is an announcement of CVE-2017-2636, which is a race condition in the n_hdlc Linux kernel driver (drivers/tty/n_hdlc.c). It can be exploited to gain a local privilege escalation. This driver provides HDLC serial line discipline and comes as a kernel module in many Linux distributions, which have CONFIG_N_HDLC=m in the kernel config.”

Popov fixed the issue by using “standard kernel linked list protected by a spinlock and got rid of n_hdlc.tbuf. In the case of transmission error, the current data buffer is put after the head of tx_buf_list,” he wrote on the mailing list.

The issue is affecting major distributions, including Red Hat Enterprise Linux. According to a Red Hat Bugzilla submission, although RHEL 5 is unaffected, the bug does affect the Linux kernel packages shipped with Red Hat Enterprise Linux 6 and 7 and Red Hat Enterprise MRG 2. Because this issue is rated important, it has been scheduled to be fixed in future updates for the respective releases. Canonical has already released a patch; SUSE is working on it.

The bug is old, and the module is used in really old hardware; even if the module is shipped with modern Linux distributions, it’s never loaded by default. However, the module is automatically loaded “if an unprivileged user opens a pseudoterminal and calls TIOCSETD ioctl for it setting N_HDLC line discipline,” explained Popov.

One might wonder why users should worry about it. Steven J. Vaughan-Nichols explained, because “it's easy to do, which means it's easy for a local user to exploit. Before poo-pooing this as a non-issue, keep in mind that with hosted and cloud computing, many people have ‘local’ access to Linux servers.”

As always, check your distribution and run updates to patch the flaws.