Zero-day flaw leaves millions of Linux and Android users vulnerable

An Israeli cyber research group has discovered a critical zero-day vulnerability in the Linux kernel, which has the potential to affect millions of Linux PCs and servers. Furthermore, given that some of the code is shared, the same flaw will affect more than two-thirds of all Android devices. A zero-day vulnerability is an undisclosed computer application vulnerability, which cyber criminals can exploit to target a network, computers, data or programs. Perception Point discovered that the flaw allows an attacker to use local user privileges to the highest ‘root’ level of an operating system. From here they can view private information, install malware, and delete files. The vulnerability has been present since 2012 and affects any operating system with Linux kernel 3.8 or higher. It also affects Android versions KitKat and higher. Linux has been informed and a patch is expected shortly. There is no auto update for the kernel so all Linux servers need to be patched. Typically flaws in Linux kernel are patched as soon as they are discovered, which leads many to view Linux-based operating systems as more secure than others. In this respect, the fact that this flaw has been in existence for three years is of concern.

A new, previously undiscovered flaw that allows an attacker to escalate local user privileges to the highest "root" level is said to hit "tens of millions" of Linux PCs and servers.

Because some of the code is shared, the zero-day flaw also affects more than two-thirds of all Android devices.

Israeli security firm Perception Point disclosed the flaw in a blog post Tuesday, but it wasn't immediately clear if the bug had been privately reported to Google, which develops the Android software.

Perception Point said in an email that it has released a proof-of-concept exploit following collaboration with a number of Linux distribution teams.

The flaw, said to date back to 2012, affects Linux kernel versions 3.8 and higher, which extends to devices running Android KitKat 4.4 and higher. The vulnerability is in the keyring facility, baked into the core of the Linux software. If exploited, an attacker would be able to execute code on the Linux kernel, and extract cached security data, which can include in some cases encryption and authentication keys.

The Israeli security firm said it had no evidence to suggest the flaw had been exploited in the wild.

A patch is expected to be released on January 19 for most Linux machines.

Red Hat has already patched its systems, according to a security advisory, with other distributions expected to follow up in the coming day.

It is not known if Google was aware of the bug before Perception Point published its findings. The Android maker will likely fix the bug as part of its scheduled monthly security updates in February.

A Google spokesperson did not comment.

This post has been updated.