linux-kernel - Re: milw0rm rootkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20110314201216.0b19d12b@lxorguk.ukuu.org.uk>
Date:	Mon, 14 Mar 2011 20:12:16 +0000
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Justin <wellspring3@...il.com>
Cc:	Steven Rostedt <rostedt@...dmis.org>, linux-kernel@...r.kernel.org
Subject: Re: milw0rm rootkit

On Mon, 14 Mar 2011 12:28:11 -0700
Justin <wellspring3@...il.com> wrote:

> Yes, she runs 2.6.34.8-68.fc13.i686.PAE
> 
> I know this is for the kernel... The C file seems to exploit a
> vulnerability in the kernel, so I thought I should let the kernel
> people know so they could patch it upstream. Right? I know the hacker
> couldnt have gotten in if the security was stronger, but shouldnt the
> kernel be secured against the rootkit?

Firstly 2.6.34 is an old kernel, and we've no idea what other patches and
the like are in the Fedora version. You should ask the Fedora people
about that. Secondly the answer is no - there are various bits of user
space that are privileged and bugs in those can lead to exploitation
without the kernel being involved, particularly if you are not using
security containment setups like SELinux.

You need to talk to the distro.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/