User: Password:
|
|
Subscribe / Log in / New account

A privilege escalation flaw in udev

A privilege escalation flaw in udev

Posted Apr 23, 2009 7:09 UTC (Thu) by jimparis (subscriber, #38647)
Parent article: A privilege escalation flaw in udev

Kay's commit message is:
"libudev: monitor - unify socket message handling"

It would be nice to at least hint at the fact that this fixes a critical security flaw... the release notes for udev 141 didn't even suggest that there was any reason to upgrade: http://lwn.net/Articles/328340/

That's pathetic.


(Log in to post comments)

A privilege escalation flaw in udev

Posted Apr 23, 2009 14:12 UTC (Thu) by BenHutchings (subscriber, #37955) [Link]

No, that commit does what it says. The commit that fixed this bug was made by Scott James Remnant and has the subject "libudev: monitor - ignore messages from unusual sources". This is not entirely explicit, but it may not have immediately occurred to him that this was a severe security flaw. I can say that he was fairly quick to notify others about it.

A privilege escalation flaw in udev

Posted Apr 23, 2009 17:08 UTC (Thu) by jimparis (subscriber, #38647) [Link]

That is not true. Go look at Kay's commit. It adds the SO_PASSCRED option to the socket and adds an explicit check for (cred->uid != 0). As the LWN writeup indicated, 'either patch "alone would be sufficient" to fix the problem'. And your statement about him being quick to notify others is misleading at best. There has still not been a single posting on the udev mailing list about this problem!


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds