Linux system vendors and users must address one of the most serious security vulnerabilities discovered in the operating system in a very long time. Dirty Pipe essentially allows attackers to take full control. The name given to the vulnerability refers to the Dirty Cow vulnerability that caused a stir in 2016. This made it possible, for example, to gain full control over the many Linux-based Android smartphones.
However, security researchers became aware of the issue at the time when they investigated an attack on their own servers using an exploit against the vulnerability. Dirty Pipe has similar potential in terms of possible damage according to one report Ars Technicas comes forward. The problem lies in the implementation of the so-called pipelines, through which different processes running on a Linux system can exchange data with each other. A security researcher discovered the problem when he investigated the reason why several files belonging to a customer of the website builder CM4all were defective.
The analysis eventually took several months and as a result revealed a bug in the Linux kernel. This allowed any user with an account to smuggle their own SSH key into the root account. You can of course use this to get maximum access to the system over the network connection. The attack could even be carried out via user accounts with the lowest privileges.
Closer analysis of the problem showed that the unauthorized integration of an SSH key was just one possible action. This way, SUID binaries can also be hijacked and access the root shell or overwrite the contents of write-protected files. The vulnerability was first discovered in Linux kernel 5.8. The vulnerability has been fixed in kernel versions 5.16.11, 5.15.25, and 5.10.102 released last week and it is therefore strongly recommended to perform the corresponding updates.
Digital marketing enthusiast and industry professional in Digital technologies, Technology News, Mobile phones, software, gadgets with vast experience in the tech industry, I have a keen interest in technology, News breaking.
