Unpatched Linux Kernel Vulnerabilities

Question

I recently found out that there are several vulnerabilities in the linux kernel that allow for privilge escalation, that have not been patched yet in the major distributions, and have public exploits on the usual sources. For example, I could get root on any of my completely up to date Ubuntu 10.04 systems using this very simple exploit.

This kind of worries me. Two questions arise:

• Why has the linux kernel not been patched for an exploit that has been around for 2 weeks? This sounds like a very dangerous situation to me.

• Is there a safe way to give someone a guest account on my machine, given this situation? Or should I assume a guest account is more of a symbolic security, and only give accounts to people that I really trust.

Answer 1

Actually a patch was written on September 14th and can be found here and here. However this patch has not been merged over to the mainline. Kernel programming is very difficult. A patch can break compatibility or cause the system to behave incorrectly. Microsoft usually takes 1 month to write a patch for anything, even notepad.

Often times an attacker can compromise a user-level process such as one of your Daemons (unrealircd or sendmail). Or even more likely a web application like Wordpress or PHP-Nuke. At this point the attacker has a user account and can obtain root if he needs it. So privilege escalation exploit like this is often used in a chain with other exploits.

On a more concerning note Toravolds is notorious for silent patches. This is also a pastime that Microsoft enjoys.

Answer 2

According to lwn.net :

For the more community-oriented distributions (Debian, Fedora, openSUSE, Ubuntu, and others), the response has been somewhat mixed. Ubuntu, Debian, and Fedora had fixes out on September 17 for both bugs (or, in the case of Debian, just one, as its stable distribution ("Lenny") is based on 2.6.26 and thus not vulnerable CVE-2010-3301). openSUSE has yet to release a fix and none of the secondary distributions that we track (Gentoo, Mandriva, Slackware, etc.) has put out a fix either.

So if your ubuntu is really up-to-date, it shouldhave been safe quite early. Plus I remember seeing the update relatively soon after the bug was announced.

So either the fix is incorrect, or your system are not updated correctly, and have not been for something like two weeks. Kernel updates need a reboot of your system.

Where is the programming question, by the way ?