Kernel exploit on 64-bit operating systems

piperts · 09-18-2010, 04:25 AM

I've seen the latest exploit for RHEL/CentOS operating systems running 64bit. So far i've temporarily disabled 32bit application execution.

The exploit information: https://access.redhat.com/kb/docs/DOC-40265

I'm running CentOS 5.5 64bit and am wondering if there is a permanent fix available?

smoker · 09-18-2010, 05:06 AM

The page you linked to is only 2 days old. When you next receive any updates, if a fix has been issued it will be part of the updates.

win32sux · 09-18-2010, 03:14 PM

Quote:

Originally Posted by piperts

I've seen the latest exploit for RHEL/CentOS operating systems running 64bit. So far i've temporarily disabled 32bit application execution.

The exploit information: https://access.redhat.com/kb/docs/DOC-40265

I'm running CentOS 5.5 64bit and am wondering if there is a permanent fix available?

On Ubuntu, we received updated kernel packages which addressed this vulnerability (as well as an additional one) yesterday IIRC, so I would expect Red Hat to be doing the same RSN. So yes, there's a permanent fix but you need to wait for your updated kernel package to arrive unless you want to apply the patch on your own and re-compile your kernel.

win32sux · 09-19-2010, 12:58 AM

FYI, this issue has made it to Slashdot.

EDIT: BTW, I'm gonna sticky this thread for a few days.

piperts · 09-19-2010, 04:09 AM

Thanks for the advice win32sux and smoker.

Here is the bugzilla report - https://bugzilla.redhat.com/show_bug...=CVE-2010-3081

qweasd · 09-20-2010, 12:22 PM

Anyone else was able to compile this exploit? (Careful, it may be leaving backdoors in RAM.) I cannot because __i386__ is not defined. Note that this CVE-2010-3081 is different from CVE-2010-3301, which is nicely documented and has a working exploit which appears to be clean.

beadyallen · 09-20-2010, 03:21 PM

Yes, the exploit compiles with one very minor change. Probably against the rules to say what it is, but once compiled it works silently on a fresh Centos 5 installation. We're waiting for the kernel fix. It's quite a serious flaw (especially given the availability of the exploit).

smoker · 09-20-2010, 03:47 PM

Quote:

Originally Posted by qweasd

(Careful, it may be leaving backdoors in RAM.)

Hardly a backdoor really. reboot and it's gone.

rsciw · 09-21-2010, 05:17 AM

here's the RHN link
https://rhn.redhat.com/errata/RHSA-2010-0704.html