Suse warns of hole in Linux kernel

[DnetMHZ]

HERE

Apparently the hole has to do with the 2.6 implementation of iptables logging.

 

[groovin]

interesting... not running iptables on kernels older that 2.6.8 over here so i guess im in the clear!

 

[n0cmonkey]

That's a bad place to have a bug...

 

[DnetMHZ]

Originally posted by: n0cmonkey
That's a bad place to have a bug...

very, you'd expect a firewall to keep things OUT.

 

[drag]

It doesn't actually let anything pass the firewall. It's a DOS attack and has to do with the iptables logging facilities, it'll crash your computer.

No remote exploits...

It's the 2nd serious exploit in 2.6 series kernels, btw. Fixed with 2.6.8 and newer.

secunia report.

 

[Nothinman]

very, you'd expect a firewall to keep things OUT.

It does. The gotcha is that if this bug is exploited the box crashes and keeps everything out.

 

[drag]

Originally posted by: Nothinman

very, you'd expect a firewall to keep things OUT.

It does. The gotcha is that if this bug is exploited the box crashes and keeps everything out.

So are you saying that's the kernel developers doing a little bit TOO good of a job?

(also, would it be possible to move something like iptables out of the kernel and into userland?)

 

[Nothinman]

(also, would it be possible to move something like iptables out of the kernel and into userland?)

Probably, but I would imagine it would be incredibly slow. Every packet that came in would need to be passed to the userland program for inspection and possibly modification and then that program would have to pass it back to the kernel or let the kernel know that the packet was dropped and whether or not to send back a bad response (i.e. ICMP unreach, RST, whatever).

 

[spyordie007]

So are you saying that's the kernel developers doing a little bit TOO good of a job?

Though it does block everything I wouldnt consider the box crashing a "good" job. 😉

(also, would it be possible to move something like iptables out of the kernel and into userland?)

Feel free to correct me if I'm wrong, but I'm under the impression it's dont at the kernel for performance reasons; overhead would be much higher if it were done at the user level.

 

[n0cmonkey]

Originally posted by: spyordie007

So are you saying that's the kernel developers doing a little bit TOO good of a job?

Though it does block everything I wouldnt consider the box crashing a "good" job. 😉

Still better than a remote root exploit. 😉

(also, would it be possible to move something like iptables out of the kernel and into userland?)

Feel free to correct me if I'm wrong, but I'm under the impression it's dont at the kernel for performance reasons; overhead would be much higher if it were done at the user level.

Correct.

 

[Nothinman]

Feel free to correct me if I'm wrong, but I'm under the impression it's dont at the kernel for performance reasons; overhead would be much higher if it were done at the user level.

That and constantly copying data to/from user memory is just waiting for an even bigger exploit.