Advanced

This week at LWN: A privilege escalation flaw in udev

Posted by Scott_Ruecker on · 7 comments
LWN.net; By Jake Edge 		Mail this story
Print this story

A vulnerability in udev, the user-space tool that manages the Linux /dev tree, has left unpatched systems vulnerable to a local root privilege escalation. Exploits are already circulating on the full-disclosure mailing list, so it is rather important for users and administrators to update their systems. The problem was caused by the way udev processes the messages it receives—certain kinds of messages, which could be generated by user processes, were not considered. That oversight led to the vulnerability.

Full Story

  Nav
» Read more about: Groups: Linux; Story Type: News Story

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (7)

azerthoth ·
The escalation bug isn't new news, I cant remember the exact day, but 2 weeks ago seems about right for when Daniel fixed udev in Funtoo. I remember talking to him about it for a few minutes.

Way to cover an already been fixed LWN.
Scott_Ruecker ·
I can only post articles that have been released to non-subscribers..that is why all the articles that we post of theirs are a couple of weeks old, at least. I do try to get them out as soon as they are available though..sorry azer.
azerthoth ·
ah I didnt look at the date on the original article, retract and redirect my sarcasm at the LXer Alpha Poodle.

*evil grin*
krinpaus ·
Excuse me, the article on LWN was posted on April 22.

http://lwn.net/Articles/329266/

At that time, it was posted for subscribers only.

LWN is an excellent site for "Linux" news, especially the Weekly Summary posted on Thursdays. Sorry, that's subscribers, too, but they do offer tiered subscriptions, based on a sliding scale. If you can't afford any of the tiers, then you'll need to wait until the article, such as this one, is available for public consumption, I believe it's a 2-week period.

You should be able to also read the comments to this udev issue. You might find some interesting...

OK, too late I see this has been addressed...

tuxchick ·
azerthoth, our Fearless Benevolent Galactic Overlord is no poodle. I believe he is more akin to a Portuguese Water Dog http://en.wikipedia.org/wiki/Portuguese_water_dog

These are tough, hardy dogs that can work on fishing boats and swim in rough icy waters that turn a Poodle into a dogsicle in seconds. Though I doubt they can play drums in a metal band.

Scott, those without hair are always envious of those with.

;)
jdixon ·
> ...our Fearless Benevolent Galactic Overlord is no poodle...

All together now: "You ain't nothin' but a hound dog..."
Scott_Ruecker ·
Poodles are sanctioned to exist but should never be worn..or hound dogs either.

Regards,

Your Fearless Benevolent Galactic Overlord

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post