A vulnerability nicknamed “Stack Clash” allows an attacker to gain root privileges on a UNIX system and take over vulnerable machines.
The flaw was discovered last month by security researchers from Qualys, who worked with various vendors to make sure patches are available before going public with their findings.
According to Qualys researchers, the issue affects a host of *NIX systems, such as Linux, OpenBSD, NetBSD, FreeBSD, and Solaris. Researchers only tested Stack Clash on the i386 and amd64 platforms, and they don’t exclude that other vendors and platforms may also be affected.
Issue was first discovered back in 2005
At the heart of this vulnerability is an issue that has been known since 2005, patched, then rediscovered to be vulnerable again in 2010, patched, and now discovered again.
This issue revolves around the notion of stacks, which are memory regions where applications execute code inside the computer’s RAM. As a program grows, an app’s stack also grows.
The problem is when one memory stack grows too much and gets too close to another program’s stack. In 2005, 2010, and again in 2017, researchers have found a way to confuse the operating system and leak code from one stack to another.
Qualys researchers have released proof-of-concept code that jumps low-level code from a malicious app’s memory stack to the memory region of a legitimate app that has root access.
Attacker needs local access. Remote exploitation unknown.
This attack is a classic elevation of privilege (EoP) vulnerability. EoP flaws are not considered dangerous because they usually require an attacker to be already present on the user’s system.
Qualys says it put together proof-of-concept exploits for Stack Clash on various operating systems, which it intends to release at a later date. All PoCs require an attacker to have local access, but researchers don’t rule out scenarios where an attacker could exploit Stack Clash from a remote location (via HTTP requests or JavaScript code, for example).
At the time of publishing, only Red Hat has issued a security patch for the Stack Clash vulnerability, but Qualys says other vendors will soon follow suite.
If users can’t update, OS owners can set the RLIMIT_STACK and RLIMIT_AS of local users and remote services to lower values. Taking this action will, inadvertantly, have some impact on the machine’s performance, as apps will have less memory to work with.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
