Account
♦ Password
♦ Mailsetup
♦ Info
Services
♦ Workstations
  ♣ Linux
  ♣ MacOS
♦ E-Mail
♦ Chat
♦ Files
♦ Backups
♦ Printers
♦ Network
♦ Statistics
♦ Downloads
♦ Links
News
♦ Newsletter
♦ Submit
♦ Search
Readme
Hacks
♦ Linux
Tools
Contact
About


  Yet Another Local Root Exploit in Linux Kernel 2.6
Linux Posted by Axel Beckert on Monday July 17, @02:30PM
from the it's-been-a-hard-day's-night-ehm-weekend dept.
Although there was a local root exploit fixed recently in some versions of the Linux 2.6 Kernel which resulted in Kernel 2.6.17.4, on Friday night another local root exploit using a race condition in the /proc file system (CVE-2006-3626) became public, this time concerning all previous 2.6 kernels. So on Saturday morning Kernel 2.6.17.5 has been released, which fixed this vulnerability. Then the developers noticed that the fix was "a bit to draconic" which means that in some cases it prevented to much, and released 2.6.17.6 on Sunday.

So if you run a computer using a Linux 2.6 Kernel less than 2.6.17.5, please update as soon as possible to 2.6.17.6. If you have already updated to Kernel 2.6.17.5 this weekend and it works for you, it's fine, too.

As with the update to Kernel 2.6.17.4, workstations with Kernel 2.6 which are managed by us have been updated already.

Update: If you experience trouble with ps not showing all processes as user, you found the difference between Kernel 2.6.17.5 and 2.6.17.6 and should probably upgrade.

<  |  >

 

  Related Links
  • Articles on Linux
  • Also by Axel Beckert
  • Contact author
  • The Fine Print: The following comments are owned by whoever posted them.
    ( Reply )

    Re: Yet Another Local Root Exploit in Linux Kernel 2.6
    by asier on Sunday August 20, @06:17AM
    local root
    [ Reply to this ]
    The Fine Print: The following comments are owned by whoever posted them.
    ( Reply )

    © 2003 ISG, Departement Physik, ETH Zürich, <isg@phys.ethz.ch>