bugtraq - Linux kernel source archive vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060907182304.GA10686@danisch.de>
Date: Thu, 7 Sep 2006 20:23:04 +0200
From: hadmut@...isch.de (Hadmut Danisch)
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Linux kernel source archive vulnerable

Hi,

there's a severe vulnerability in the Linux kernel source code archives:

The Linux kernel is distributed as tar archives in the form of
linux-2.6.17.11.tar.bz2 from kernel.org. It is usually unpacked,
configured and compiled under /usr/src. Since installing a new kernel
requires root privileges, this is usually done as root.

When unpacking such an archive, tar also sets the uid, gid, and file
permissions given in the tar archive. Unfortunately, plenty of files and
directories in that archive are world writable. E.g. in the 2.6.17.11
archive, there are 1201 world writable directories and 19554 world
writable files.

This opens the door for at least three kinds of attacks:

1. Whoever manages to exploit any server (e.g. PHP on a webserver) has
   world writable directories at a well defined place, perfect to hide
   any malware, bot, rootkit,...

2. Any user or intruder can modify the kernel source and thus compromise
   the kernel to be compiled.

3. any user or intruder could modify the build or installation
   system/Makefiles in order to have any kind of malware executed by
   root the next time a kernel is built or installed, or any other
   kernel module making use of the kernel tree.

Solution: Ensure that the file ownership and permissions are set
properly before distributing the tar archive.

regards
Hadmut