"Hole in the Linux kernel allows root access" - Do we have to worry?

[coldReactive]

What?

One time there was a fix released, but that only meant that the fix was shown to all who would want to commit it.

Fix Released =/= Fix Commited

[MasterNetra]

One time there was a fix released, but that only meant that the fix was shown to all who would want to commit it.

Fix Released =/= Fix Commited

Don't you mean Fix Released != Fix Committed ? != (Not Equal)

[FuturePilot]

One time there was a fix released, but that only meant that the fix was shown to all who would want to commit it.

Fix Released =/= Fix Commited

Are you referring to bugs that are linked from upstream bug trackers in launchpad? If so, then yes sometimes those can be marked as fixed before it makes it into Ubuntu, but I see no such link in that bug report.

I think you're confusing some of the bug status. https://wiki.ubuntu.com/Bugs/Status

[MrNatewood]

if you have a kernel before 2.6.32 yes, ubuntu does have root, you just can't login as root. The vulnerability is minimised unless you have wine or dosbox installed in which case it is still there. If you run

cat /proc/sys/vm/mmap_min_addr

if you get 0 you are bulnerable
if you get >0 you are safe

edit erm when i said >0 i think i was wrong it has to be a big number

So... How do I keep wine working and not be vulnerable?

[coldReactive]

So... How do I keep wine working and not be vulnerable?

Remove Z: which is set to the whole file system /

If you do this however, you'll have to run all your wine apps in drive_c folder from now on.

[samjh]

Doesn't Karmic Come with it fixed?

Not sure, but when I tried sysctl vm.mmap_min_addr on my Karmic system (with wine installed), it returned 0 which means it would be vulnerable. Whether or not it really is vulnerable is another question, because a default Ubuntu installation has no root account.

BTW, it looks like a diligent member of our community has reported it:
https://bugs.launchpad.net/ubuntu/+s...mu/+bug/401950

So with dosemu or wine installed, it could be (not necessarily is) vulnerable, but I'll leave that to be answered by a member of the security team or other appropriately educated persons.

[FuturePilot]

Not sure, but when I tried sysctl vm.mmap_min_addr on my Karmic system (with wine installed), it returned 0 which means it would be vulnerable. Whether or not it really is vulnerable is another question, because a default Ubuntu installation has no root account.

BTW, it looks like a diligent member of our community has reported it:
https://bugs.launchpad.net/ubuntu/+s...mu/+bug/401950

So with dosemu or wine installed, it could be (not necessarily is) vulnerable, but I'll leave that to be answered by a member of the security team or other appropriately educated persons.

Ubuntu does have a root account, it's disabled though. So yes it is possible to get a root shell through an exploit.

[dixie460]

I uninstalled Wine, rebooted, and ran this code
cat /proc/sys/vm/mmap_min_addr
and still got a 0. Do I need to be concerned? I can't find how to take care of this problem anywhere, does anyone on here know how?

Thanks

Andy

[MasterNetra]

I uninstalled Wine, rebooted, and ran this code
cat /proc/sys/vm/mmap_min_addr
and still got a 0. Do I need to be concerned? I can't find how to take care of this problem anywhere, does anyone on here know how?

Thanks

Andy

Apparently yes for as long as it is zero. However there is a fix and you can still theoretically run Wine.

According to: http://www.itworld.com/security/8391...tant-linux-fix

All you have to do is sudo the command (sense just entering yields our favorite insufficient access reply):

 sysctl -w vm.mmap_min_addr="1024"

however the 1024 can be any number up to 65535. This fix however is only good until you reboot. Though I suppose you could setup a script or something. How you would do a script for a limited account I have no clue.

[Mornedhel]

if you have a kernel before 2.6.32 yes, ubuntu does have root, you just can't login as root. The vulnerability is minimised unless you have wine or dosbox installed in which case it is still there.

FYI, I have dosbox installed and:

sysctl vm.mmap_min_addr

returns "vm.mmap_min_addr = 65536", on Karmic.