Vulnerability persists in different Linux distros
Multiple Linux distributions (distros), including all current versions of Red Hat Enterprise Linux and CentOS, contain a recently disclosed vulnerability that provides attackers with full root access into systems vulnerable to the flaw, as reported by specialists in ethical hacking from the International Institute of Cyber Security.
The overflow error (identified as CVE-2018-14634) exists in the critical functions of the Linux kernel for memory management and allows attackers without local privileges to access the system and perform a privilege escalation. Specialists in ethical hacking discovered the vulnerability and developed a proof of concept of the exploit.
A patch for this vulnerability, called “Mutagen Astronomy” by its discoverers, is already available, and most Linux distributions have already adapted to the older versions of their kernels. However, Red Hat Enterprise and CentOS distributions have not yet been patched.
In a statement, Red Hat mentions that the incident directly affects the versions of Red Hat Enterprise 6, 7, and RHEMRG 2. Systems with less than 32 GB of memory are not under known threat so far “because they do not have enough storage capacity to exploit the vulnerability”, the company say.
The vulnerability has reached a score of 7.8/10 in the Common vulnerability Scoring System (CVSS), although Red Hat considers it to be a high-risk failure because it has a serious impact on the confidentiality, integrity and availability of the affected systems. The manufacturer described the flaw as “exploitable without user interaction”, and the complexity of exploitation is really low.
Jimmy Graham, the specialist in ethical hacking who revealed the vulnerability, mentions that the name of the flaw (Mutagen Astronomy) is an anagram of the expression “too many arguments” which is the vulnerability that is being primarily exploited.
“This flaw is another reminder of the importance and the need to apply different layers of protection”, mentions the expert. “Often, attackers who exploit remote vulnerabilities, such as exploits in web applications, for example, only gain privileged access to vulnerable systems”.
“Commonly cybercriminals combine the use of low-impact vulnerabilities with more severe ones to create a more functional attack; vulnerabilities such as Mutagen Astronomy are used in conjunction with other types of attacks. If the attackers have a foothold to enter a system, but they cannot reach the root, they can use a vulnerability like this to compromise the system completely”, the expert said.
Linux developers designed the patch for this bug based on previous experiences with other vulnerabilities; most Linux distros are adapting the patch for older versions of their products, a work known as “patch backporting” in the field of computer security.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
