Old unfixed Linux bug grants full root server access

Dubbed as “Dirty COW,” this Linux bug could potentially grant unauthorized server access which can lead to a whole lot of mayhem on the internet. Image INQUIRER.net

Linux is often the OS used in data centers and networked computers that hold vast amounts of data. So when a bug or exploit pops up, it’s best to fix it immediately. However, one such exploit has gotten past programmers for years and may now pose a serious security liability.

The said exploit attacks a 9-year-old Linux kernel flaw (CVE-2016-5195), which was found by Phil Oester. He says that the attack is “”trivial to execute, never fails and has probably been around for years,” reports Engadget.

This kernel flaw had already been patched 11 years ago by Linus Torvalds, the man behind Linux, but was unfortunately undone to be fixed several years later. Oester estimates that the kernel flaw has been exploitable since 2007.

An unpriviledged local user could take advantage of this flaw to get root access to servers. With the majority of the world already wired and connected through the internet, this could be a very bad thing indeed. While an existing account on a server is required for this attack, it can potentially still be used for Linux machines that allow file executions, something common to internet servers.

Torvalds said that the race condition flaw had once been “purely theoretical.” However, improved VM technology has made it much easier to trigger. A patch for the bug—dubbed “Dirty COW” (copy-on-write)—has been created by the ones that hold the Linux Kernel. Meanwhile, distributors like Red Hat have classified the bug as “important” and are currently working on releasing updates.

With the threat of unauthorized root server access, it can’t be stressed any further as to how serious this bug is and as such Oester recommends that all Linux users patch their systems ASAP.  Alfred Bayle