Zero-day flaw leaves millions of Linux and Android users vulnerable

An Israeli cyber research group has discovered a critical zero-day vulnerability in the Linux kernel, which has the potential to affect millions of Linux PCs and servers. Furthermore, given that some of the code is shared, the same flaw will affect more than two-thirds of all Android devices. A zero-day vulnerability is an undisclosed computer application vulnerability, which cyber criminals can exploit to target a network, computers, data or programs. Perception Point discovered that the flaw allows an attacker to use local user privileges to the highest ‘root’ level of an operating system. From here they can view private information, install malware, and delete files. The vulnerability has been present since 2012 and affects any operating system with Linux kernel 3.8 or higher. It also affects Android versions KitKat and higher. Linux has been informed and a patch is expected shortly. There is no auto update for the kernel so all Linux servers need to be patched. Typically flaws in Linux kernel are patched as soon as they are discovered, which leads many to view Linux-based operating systems as more secure than others. In this respect, the fact that this flaw has been in existence for three years is of concern.

Linux kernel that could allow attackers to gain root level privileges by running a malicious Android or Linux application on an affected device. A new critical zero-day vulnerability has been discovered in thethat could allow attackers to gain root level privileges by running a malicious Android or Linux application on an affected device.





The critical Linux kernel flaw ( CVE-2016-0728 ) has been identified by a group of researchers at a startup named Perception Point.

The vulnerability was present in the code since 2012, and affects any operating system with Linux kernel 3.8 and higher, so there are probably tens of millions of computers, both 32-bit and 64-bit, exposed to this flaw.





However, the most bothersome part is that the problem affects Android versions KitKat and higher, which means about 66 percent of all Android devices are also exposed to the serious Linux kernel flaw.





Impact of the Zero-Day Vulnerability





An attacker would only require local access to exploit the flaw on a Linux server.





If successfully exploited, the vulnerability can allow attackers to get root access to the operating system, enabling them to delete files, view private information, and install malicious apps.

"It's pretty bad because a user with legitimate or lower privileges can gain root access and compromise the whole machine," Yevgeny Pats, co-founder and CEO at security vendor Perception Point, said in a blog post published today.

"With no auto update for the kernel, these versions could be vulnerable for a long time. Every Linux server needs to be patched as soon the patch is out."

Usually, flaws in Linux kernel are patched as soon as they are found; therefore, Linux-based operating systems are considered to be more secure than others. However, zero-day vulnerability recently discovered in the Linux kernel made its way for almost 3 years.

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session



The Cause of the Critical Linux Kernel Vulnerability

Reference Leak in the keyrings facility built into various flavors of Linux. The keyrings facility is primarily a way to encrypt and store login data, encryption keys and certificates, and then make them available to applications. The vulnerability is actually the result of ain the keyrings facility built into various flavors of Linux. The keyrings facility is primarily a way to encrypt and store login data, encryption keys and certificates, and then make them available to applications.





However, a reference leak could be abused by attackers to ultimately execute arbitrary code in the Linux kernel.





So far, the researchers said, no exploits have been discovered in the wild that take advantage of this vulnerability.





Perception Point has provided a technical analysis of the vulnerability and how one can exploit it, including proof-of-concept (PoC) exploit code published on its Github page.





Patch Expected to Roll Out Soon





The good news is that Perception Point has already reported the flaw to the Linux team, and patches are expected to roll out today to devices with automatic updates.



