A new Linux kernel vulnerability that can only be locally exploited is nonetheless proving a bit of a nuisance.
The CVE-2018-14634 vulnerability relates to a local privilege escalation bug in the Linux kernel, and creates a means to obtain root (administrator) privileges on a hacked system.
Security researchers at cloud security firm Qualys discovered the vulnerability, which stems from an integer overflow in the Linux kernel’s create_elf_tables() function. It’s not remotely exploitable, thanks heavens, but on a vulnerable 64-bit system, a “local attacker can exploit this vulnerability via a SUID-root binary and obtain full root privileges,” Qualys warns.
Security researchers at Qualys explain: “Even though all Linux kernels are technically vulnerable, this issue is mitigated by a one-year-old patch that was backported to most long-term kernels and makes exploitation impossible.”
“Red Hat Enterprise Linux and CentOS hadn’t yet backported this patch leaving them both initially still vulnerable. Some versions of Debian 8 were also at risk at the time of the bug’s discovery. These various shortcomings have since been addressed.”
Job done, security researchers at Qualys took time out to come up with a name for the vulnerability, which they subsequently dubbed “Mutagen Astronomy” – an anagram of “Too Many Arguments”.
Source: https://www.theregister.co.uk/2018/09/27/mutagen_astronomy_linux/
Submitted by: Arnfried Walbrecht
Comments are closed.