Zack's Kernel News
Kernel News
Zack covers: When a Security Hole Is OK; Kernel Documentation Updates; and Security Through Obscurity
When a Security Hole Is OK
Eric W. Biederman recently posted a patch to replace a 32-bit counter with a 64-bit counter. This would fix the problem that, as he put it, "With care an attacker can cause exec_id wrap and send arbitrary signals to a newly exec'd parent."
He added that he had tested this hole and found that he could wrap the 32-bit exec_id and exploit the problem in two weeks. Faster systems, of course, could do it more quickly.
However, Eric did acknowledge that on 32-bit CPUs, "reading self_exec_id is no longer atomic and can take two read instructions." This meant that on 32-bit systems there would be a microscopic window of time when the actual self_exec_id value would not match the value being read by the code. During that time, he said, this security hole remained exploitable.
[...]
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
US / Canada
UK / Australia
Direct Download
Read full article as PDF:
Price $2.95
News
-
Ubuntu 20.10 now supports Raspberry Pi
Ubuntu 20.10 is the first release from Canonical to support the Raspberry Pi single board computer.
-
A New Linux Distribution has been Released
Emperor-OS is a new Linux distribution focused on programming, developing, and data science.
-
Ubuntu Groovy Gorilla Beta Available
The beta version for Ubuntu’s latest release is now available for testing.
-
Microsoft is Finally Set to Release Edge Browser for Linux
Chromium-based MS Edge browser will soon be available for testing on Linux.
-
Lenovo Now Offering Ubuntu 20.04 as an Option
Lenovo is making good on its promise to support Linux as a pre-install option.
-
Linux Deepin 20 Released
One of the most beautiful Linux distributions on the market has been refreshed.
-
A New Version of Zorin OS is Now Available
Fan-favorite, Zorin OS 15.3 is officially available.
-
Lenovo Now Offering Fedora Linux as an Option
Lenovo is making good on their Linux promise by adding Fedora into the mix.
-
System76 Launches New High-End Laptop
System76 has unleashed a beast of a mobile workstation.
-
Mozilla Lays Off Staff, Receives More Cash
In a restructuring move, Mozilla lays off 250 employees, but then inks large deal with Google.