New Linux bug gives root on all major distros, exploit released : The Dirty Pipe Vulnerability¶

[Condobloke]

The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

New Linux bug gives root on all major distros, exploit released

A new Linux vulnerability known as 'Dirty Pipe' allows local users to gain root privileges through publicly available exploits.

www.bleepingcomputer.com

 

[KGIII]

Hmm... Interesting...

Scroll down and check the timeline. I take it they must not have thought that highly of it, 'cause it took 'em forever to fix it.

How curious...

 

[Condobloke]

Today,7th March 2022, security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe' vulnerability and stated that it affects Linux Kernel 5.8 and later versions, even on Android devices.


The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation

Timeline​

• 2021-04-29: first support ticket about file corruption
• 2022-02-19: file corruption problem identified as Linux kernel bug, which turned out to be an exploitable vulnerability
• 2022-02-20: bug report, exploit and patch sent to the Linux kernel security team
• 2022-02-21: bug reproduced on Google Pixel 6; bug report sent to the Android Security Team
• 2022-02-21: patch sent to LKML (without vulnerability details) as suggested by Linus Torvalds, Willy Tarreau and Al Viro
• 2022-02-23: Linux stable releases with my bug fix (5.16.11, 5.15.25, 5.10.102)
• 2022-02-24: Google merges my bug fix into the Android kernel
• 2022-02-28: notified the linux-distros mailing list
• 2022-03-07: public disclosure

 

[SpongebobFan1994]

While no OS will ever be perfect, and there are ways to protect yourself from these attacks, its strange to spend the last several months hearing about Linux being attacked with some kind of virus. Is there a reason for all of this?

 

[Condobloke]

Debian Security Update - DSA-5092 linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. Continue reading...

www.linux.org