New 'Looney Tunables' Linux bug gives root on major distros

3 years ago by Joe Klemmer to c/linux

From BeepingComputer.

qaz 127 points 3 years ago

A new Linux vulnerability known as 'Looney Tunables' enables local attackers to gain root privileges by exploiting a buffer overflow weakness in the GNU C Library's ld.so dynamic loader.

It’s always memory management

path: 0 4128969, hotness: undefined, score: 127, children: 21
Molecular0079 124 points 3 years ago

It’s always memory management

No wonder everyone's crazy about Rust.

path: 0 4128969 4129384, hotness: undefined, score: 124, children: 14
greybeard 62 points 3 years ago

It's certainly why it is being used to build browsers and OSs now. Those are places were memory management problems are a huge problem. It probably doesn't make sense for every match 3 game to be made in Rust, but when errors cause massive breaches or death, it's a lot safer than C++, taking human faulability into account.

path: 0 4128969 4129384 4130707, hotness: undefined, score: 62, children: 9
agressivelyPassive 21 points 3 years ago

Question would be rather: why is something like C++ needed for such simple apps?

C++ seems to be in that weird in-between place of offering high level features to be reasonable productive, but still doesn't enforce/guarantee anything to make these features safe. I'd argue, very few programs need that. Either you're writing business stuff, then you want safety (Java, C#, rust), or you're writing embedded/low level stuff, then you want control (C, ASM).

The room for "productive, but not interested in safety" is basically just AAA games, I guess.

path: 0 4128969 4129384 4130707 4134455, hotness: undefined, score: 21, children: 3
intelati 10 points 3 years ago

C is almost the old "steady" standard now it feels like. It's so flexible and the frameworks are already built..

path: 0 4128969 4129384 4130707 4134455 4136695, hotness: undefined, score: 10, children: 1
teawrecks 7 points 3 years ago

Well you're not going to write asm if you want your code to be portable at all, and believe it or not C++ has a lot of features to help you not shoot yourself in the foot that C doesn't have (ex. OOP, RAII, smart pointers).

C wasn't really designed with dynamic memory management in mind. It was designed for someone who has absolute control over a machine and all the memory in it. malloc() and free() are just functions that some environments expose to user mode processes, but C was never designed to care where you got your memory or what you do with it.

path: 0 4128969 4129384 4130707 4134455 4138163, hotness: undefined, score: 7, children: 0
kylian0087 8 points 3 years ago

What makes rust so resiliant against these types of atacks?

path: 0 4128969 4129384 4130707 4163688, hotness: undefined, score: 8, children: 4
lloram239 11 points 3 years ago
path: 0 4128969 4129384 4130707 4163688 4178222, hotness: undefined, score: 11, children: 0
ziviz 7 points 3 years ago

The short answer is Rust was built with safety in mind. The longer answer is C was built mostly to abstract from assembly without much thought to safety. In C, if you want to use an array, you must manually request a chunk of memory, check to make sure you are writing within the bounds of your array, and free up the memory used by your array when completely done using it. If you do not do those steps correctly, you could write to a null pointer, cause a buffer overflow error, a use-after-free error, or memory leak depending on what step was forgotten or done out of order. In Rust, the compiler keeps track of when variables are used through a borrowing system. With this borrowing system the Rust compiler requests and frees memory safely. It also checks array bounds at run-time without a programmer explicitly needing to code it in. Several high-level languages have alot of these safety features too. C# for example, can make sure objects are not freed until they fall out of scope, but it does this at run-time with a garbage collector where Rust borrower rules are done at compile-time.

path: 0 4128969 4129384 4130707 4163688 4167385, hotness: undefined, score: 7, children: 1
mmstick 5 points 3 years ago

The compiler enforces "aliasing XOR mutability"; utilizes "move semantics"; has a "borrowing and ownership" model; and requires the programmer to tag their references with "lifetimes". Array accesses are checked at runtime if they cannot be guaranteed safe at compile-time. Variables passed by value (moved) cannot be reused. Variables cannot be moved or mutated if any borrow to them exists. You may either have only one mutable borrow, or many immutable borrows, but never both. Therefore you cannot mutate an array while iterating on it, and you cannot have two separate unchecked references to the same array. Every function or type that accepts a borrow must be able to annotate the lifetimes of references to ensure that references are always dropped in the correct order to prevent dangling references. Rust requires developing software with discipline using patterns that satisfy all of these constraints.

path: 0 4128969 4129384 4130707 4163688 4181800, hotness: undefined, score: 5, children: 0
Unkend 22 points 3 years ago
path: 0 4128969 4129384 4134089, hotness: undefined, score: 22, children: 3
agressivelyPassive 50 points 3 years ago

But it's harder and easier to spot.

You'll never be 100% safe, but a proper lock is better than a "plz no steal" note.

path: 0 4128969 4129384 4134089 4134222, hotness: undefined, score: 50, children: 0
baseless_discourse 7 points 3 years ago

Yes, it was just discovered on this year's POPL that rust's type system is not sound with respect to deadlock freedom.

https://dl.acm.org/doi/abs/10.1145/3571229

(of course this is not arguing that everyone should stay on C or CPP, just confirming the point that Rust will allow stupid things.

path: 0 4128969 4129384 4134089 4154071, hotness: undefined, score: 7, children: 0
lloram239 5 points 3 years ago
path: 0 4128969 4129384 4134089 4178308, hotness: undefined, score: 5, children: 0
Eezyville 35 points 3 years ago

Didn't Microsoft do a study on security vulnerabilities and found that the overwhelmingly number of bugs was due to memory management?

path: 0 4128969 4129375, hotness: undefined, score: 35, children: 4
kryllic 27 points 3 years ago path: 0 4128969 4129375 4130560, hotness: undefined, score: 27, children: 2
qaz 14 points 3 years ago

That was the what I was thinking of when I wrote the comment. The CTO of Azure also said that he deems C++ in it’s entirety to be deprecated. I felt it was an exaggeration at first but I’ve started to agree with him recently.

Google also noticed a 33% decrease in Google Home crashes caused by NullPointerExceptions after switching to Kotlin. They have also declared Kotlin to be the preferred language for android.

It seems like the industry is shifting towards “safer” languages.

path: 0 4128969 4129375 4130560 4135345, hotness: undefined, score: 14, children: 1
Snowplow8861 4 points 3 years ago path: 0 4128969 4129375 4130560 4135345 4136523, hotness: undefined, score: 4, children: 0
ikidd 1 point 3 years ago
path: 0 4128969 4129375 4155957, hotness: undefined, score: 1, children: 0
MonkderZweite 13 points 3 years ago

See? All code sucks.

path: 0 4128969 4147223, hotness: undefined, score: 13, children: 0
NateNate60 49 points 3 years ago

It says "sysadmins should prioritise patching", but... has it been patched yet?

path: 0 4128533, hotness: undefined, score: 49, children: 3
datwillpowerdo 62 points 3 years ago

Just like…make a patch. It’s not that hard lol /j

path: 0 4128533 4128599, hotness: undefined, score: 62, children: 1
Actaeon 23 points 3 years ago

To show you the power of Flex Tape, I sawed this library in half!

path: 0 4128533 4128599 4129098, hotness: undefined, score: 23, children: 0
pnutzh4x0r 21 points 3 years ago

Yes, most of the major distributions have package updates with the fix. A few people have mentioned updates for Arch, Debian, and RedHat already.

Ubuntu released an update yesterday as well:

https://launchpad.net/...

Ubuntu derivatives such as Pop!_OS should have also received this update, along with the X11 patches.

path: 0 4128533 4129873, hotness: undefined, score: 21, children: 0
Veticia 33 points 3 years ago

I wonder if this could be used to root previously unrootable Android based devices.

path: 0 4128657, hotness: undefined, score: 33, children: 5
loics2 53 points 3 years ago

Android doesn't use glibc, but Bionic, a C standard library developed by Google. So I don't think this vulnerability affects Android.

path: 0 4128657 4128801, hotness: undefined, score: 53, children: 3
Knusper 9 points 3 years ago

What the heck. I thought, they were using musl.
Certainly seems like this has rather similar goals to musl...

path: 0 4128657 4128801 4134146, hotness: undefined, score: 9, children: 2
agressivelyPassive 17 points 3 years ago

That's no reason for Google not to reinvent the wheel....

They did the same with dalvik and ART now. JVMs, but more googlier!

path: 0 4128657 4128801 4134146 4134506, hotness: undefined, score: 17, children: 1
stardreamer 1 point 3 years ago

And Quic, and Pony express, and GFS...

path: 0 4128657 4128801 4134146 4134506 4172735, hotness: undefined, score: 1, children: 0
allywilson 16 points 3 years ago

Think Android uses Bionic instead of glibc (where the vulnerability is being exploited).

path: 0 4128657 4128953, hotness: undefined, score: 16, children: 0
Molecular0079 19 points 3 years ago

Just got some glibc updates in Arch yesterday. I wonder if they contain fixes for this.

path: 0 4129426, hotness: undefined, score: 19, children: 7
thurstylark 18 points 3 years ago path: 0 4129426 4135775, hotness: undefined, score: 18, children: 2
Molecular0079 8 points 3 years ago

Thanks! Not just for notifying about the fix but also showing me where package revisions are built from! I just love the transparency of Arch.

path: 0 4129426 4135775 4139281, hotness: undefined, score: 8, children: 1
aBundleOfFerrets 1 point 3 years ago

Arch is a meme, but it is honestly really cool too.

path: 0 4129426 4135775 4139281 4367135, hotness: undefined, score: 1, children: 0
palordrolap 7 points 3 years ago

Makes me wonder. LMDE got a glibc update too and Mint is very much not leading edge when it comes to non-critical updates.

Case in point, at roughly the same time as the glibc update, we (LMDE users) were upgraded to the latest Thunderbird, 115.3.1, four or five days after that sub-version came out. That's the sort of lag we generally see. (115.x was a bit of a surprise too as we've been on 102.x, but that's not strictly relevant here.)

path: 0 4129426 4133975, hotness: undefined, score: 7, children: 2
Unkend 6 points 3 years ago
path: 0 4129426 4133975 4134168, hotness: undefined, score: 6, children: 1
palordrolap 5 points 3 years ago

I only mentioned the lag to make the point that if we're getting an update at the same time as Arch that maybe it was an important one.

Anyone on Mint who finds themselves trying to leap ahead of the default release schedule might want to at least sniff around a different distro or two.

That said, Flatpaks with later versions are also often available in the provided Software Manager (basically an app store), so that's a place to look before jumping ship. Hard to tell now, but I think 115 was the Flatpak option while the, uh, default default was 102.

path: 0 4129426 4133975 4134168 4136459, hotness: undefined, score: 5, children: 0
macallik 1 point 3 years ago

Ran nala after seeing this post and got a libc update on Debian myself

path: 0 4129426 4138327, hotness: undefined, score: 1, children: 0
hornedfiend 3 points 3 years ago

Wonder if musl is fine. If so,Void people are certainly having fun now.

path: 0 4177767, hotness: undefined, score: 3, children: 1
Tnaeriv 3 points 3 years ago path: 0 4177767 4183704, hotness: undefined, score: 3, children: 0
bassomitron 1 point 3 years ago
path: 0 4128900, hotness: undefined, score: 1, children: 7
False 17 points 3 years ago

Typically there's a period of responsible disclosure to give the software maintainer an opportunity to fix it before it's widely announced. After that period is up or the fix has been released the vulnerability discoverer is able to announce it and take credit for finding it.

path: 0 4128900 4129318, hotness: undefined, score: 17, children: 2
bassomitron 1 point 3 years ago
path: 0 4128900 4129318 4130580, hotness: undefined, score: 1, children: 1
wmassingham 3 points 3 years ago path: 0 4128900 4129318 4130580 4130868, hotness: undefined, score: 3, children: 0
wisplike_sustainer 13 points 3 years ago

Distro developers were notified a month ago. At least Redhat and Debian have have published fixed versions. This is common procedure.

path: 0 4128900 4129288, hotness: undefined, score: 13, children: 0
fubo 9 points 3 years ago

It's better that vulnerabilities be discussed openly. In general, people knowing the truth allows them to make better decisions.

path: 0 4128900 4129200, hotness: undefined, score: 9, children: 0
glad_cat 9 points 3 years ago

Security through obscurity is never good.

path: 0 4128900 4130672, hotness: undefined, score: 9, children: 0
Chewy7324 3 points 3 years ago

It's not only the good guys that find vulnerabilities. There're many states and companies (selling to those governments) as well as regular criminal organizations paying people for vulnerabilities and exploits.

If the issue wasn't reported, it is likely that it would have been found by someone else at some point. It might even be known already, but just not reported.

path: 0 4128900 4131854, hotness: undefined, score: 3, children: 0
linux
linux

@lemmy.ml

login for more options
68043
9437
5656

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

  • Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
  • No misinformation
  • No NSFW content
  • No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

go to feed...