A zero-day vulnerability on the Linux operating system that gives attackers unbridled access to PCs, servers and a majority of Android devices has been found. The security flaw affects machines running version Linux 3.8 or higher. Given that version 3.8 was released in 2013, the security flaw has existed for nearly three years.
Encryption lock image from Shutterstock
The Perception Point research team discovered the vulnerability in the Linux kernel and has successfully developed a proof-of-concept exploit for it. The research firm noted that the bug has the potential to affect tens of millions of Linux PCs, servers and 66 per cent of all Android devices (any phone or tablet running Android KitKat and above). It did mention that there has yet to be a recorded case of the vulnerability being exploited but it is still crucial to patch it as soon as possible.
The bug is caused by a reference leak in the operating system’s keyrings facility, which is used for drivers to retain or cache security data, authentication keys, encrypted keys and other data in the kernel. The flaw can be exploited by an individual with local access to Linux PCs and servers or through a malicious app on Android devices.
According to the Perception Point research team:
“SMEP & SMAP will make it difficult to exploit as well as SELinux on android devices. [But] the most important thing for now is to patch it as soon as you can.”
The vulnerability has already been reported to the Linux kernel security team and patches are expected to come out shortly.
[Via Perception Point]