International Conference on on Soft Computing in Information Communication Technology (SCICT 2014)

Overview of Linux Vulnerabilities

Shuangxia Niu Jiansong Mo

State Grid HAEPC Electric Power Research Institute State Grid HAEPC Electric Power Research Institute
Henan, China Henan EPRI GAOKE Group Co. Ltd
e-mail: sxniu [email protected] Henan, China
e-mail: jiansong [email protected]

Zhigang Zhang Zhuo Lv

State Grid HAEPC Electric Power Research Institute State Grid HAEPC Electric Power Research Institute
Henan EPRI GAOKE Group Co. Ltd Henan, China
Henan, China e-mail: [email protected]
e-mail: [email protected]

Abstract—Various advanced key technologies can be also cause unexpected vulnerabilities which can be abused
effectively implemented on Linux cause its stability, high by malicious users for their attacks. By this reason, It is
efficiency and open source nature. However, Linux necessary to understand the existing vulnerabilities and
Operating System(OS) itself and some of the services related measures in Linux. Up to now, actually, there are
Linux-based inevitably have their vulnerability, namely lots of documents which aimed at a certain type of
Linux is not absolutely safe. This paper attempts to review vulnerability and related measures in Linux, but few of
and discuss the Linux vulnerabilities, which originates from them had an overview.
Linux OS itself and some of the services shipped in Linux, In this paper, the Linux vulnerabilities and related
with related cases presented. And Linux security
security measures will be studied, reviewed and discussed
enhancements, Linux OS hardening and Linux Security
Modules (LSM),are systematically described and studied.
systematically.
II. BACKGROUND
Keywords-Linux vulnerabilities ;security measures;
harden -ing; LSM Let’s start by taking a quick look at the volume of
vulnerabilities over the last 26 years, as is shown in Figure
I. INTRODUCTION 1 below[2][3].
Recently Linux OS is widely used from embedded This presents that the number of discovered and
systems to mainframes, supercomputers and servers, from reported vulnerabilities in 2013 has a slight decline than
education and science research to industry, commerce and 2012, but is markedly more than any year before 2005.
national defense etc. Linux OS, a free and open source Surprisely, the Linux kernel was having the most CVE
software collaboration: the underlying source code may be (Common Vulnerabilities and Exposures ) vulnerabilities
utilized, modified and distributed, by anyone under of all other products from 1988 to 2012,and the
licenses such as the GNU General Public License[1], distribution in four mainstream LINUX version is
therefore advanced key technologies can be rapidly presented, as shown in Figure 2 and 3 [2] respectively. The
implemented on Linux. However rapid development can following data tells us a few interesting but serious things
worth noting. More vulnerabilities information in 2013

Figure 1 Vulnerabilities by year

© 2014. The authors - Published by Atlantis Press 225

which you may be interested in can be obtained from which the address of kernel services program anti-go to
[3][4]. kernel space when Linux kernel calls int 0x80(%eax)
while the final jump is indeed using registers %rax. Then
kernel backdoor function could be executed.
Undoubtedly, there are a variety of other reasons which
causes privilege escalation. Such as, integer overflow in
the do_brk [7]function for the brk system call in Linux
kernel 2.4.22 and earlier allows local users to obtain root
privileges, and buffer overflow(CVE-2014-0049) in the
complete_ emulated_mmio function in the Linux kernel
before 3.13.6 allows guest OS users to execute arbitrary
code on the host OS by leveraging a loop that triggers an
invalid memory copy affecting certain cancel_work_item
data. Besides, missing pointer/permission checks[8] and
Figure 2 Top 10 products with the most reported vulnerability missing CPU-state sanitation(CVE-2014-1438) can also
cause privilege escalation. And We will not discuss these
reasons one by one here, actually, we can achieve more
comprehens -ive cases and details of this type
vulnerabilities from NVD, CVE, Security Focus, Secunia,
Exploit Database, Wu Yun and Sebug, etc.
B. Denial of Service vulnerability(DoS)
DoS is the act of exploiting network protocol
implemen -tation flaws deliberately or exhausting the
attacked object’s resources through brutal means
directly,and the aim is to make the target computer or
network can not provide normal services or access to
Figure 3 Vulunerabilities by Linux distribution resources, the target system to stop responding and even
system services collapse.
III. LINUX VULNERABILITIES Case: Linux kernel hash algorithm[9] vulnerability
Linux kernel hash algorithm,which is used for the
z From Linux OS Linux route catch index and fragment reassemble.When
In this section, the vulnerabilities are divided into three the Linux system receives a specially crafted packet from
types according to the consequences caused by exploiting an attacker, the hash table clash will occur led to server
these vulnerabilities. resources are exhausted.
A. Privilege Escalation Vulnerability A same value(hash address) will be get with the operati
-on of a hash algorithm for many values. To avoid address
Privilege escalation, an act of exploiting a design flaw,
clash, these values which have same hash address are
bug or configuration oversight in software application or
stored in the same hash slot, which makes the hash table
operating system to obtain elevated access to resources
into a singly-linked list. And the complexity of the
that are normally protected from user or an application.
insertion operation of this hash table soars to O(n*n) from
Thus an application with more privileges than intended by
O(n). Thus, the system will consume huge CPU resources
the system administrator or application developer can
and result in a DoS attack.
perform unauthorized actions. Various existing types of
Recently, NVD released a lot of high-risk DoS
privilege escalation attack case will be described and
vulnerab -ility in certain Linux versions. As the following
discussed to illustrate the increasing dangers of this type of
two examples:
vulnerability.
CVE-2014-2523[10], with CVSS Severity of 10 (upper
Case: Security problem with ptrace system call
limit of CVSS Severity) allows remote attackers to cause a
Via a PTRACE_SETREGS ptrace system call in a
denial of servicevia a DCCP packet that triggers a call to
crafted application, race condition in the ptrace
the (1)dccp_packet,(2)dccp_error function, or (3) dccp_
functionality in the Linux kernel before 3.7.5 (CVE-2013
new, in the Linux kernel through 3.13.6.
-0871) allows local users to obtain privileges which will
CVE-2014-0100[11],with CVSS Severity of 9.3, allows
result in unauthorized modification, unauthorized
remot e attackers to cause a denial of service and possibly
disclosure of information and service disruption.
have other unspecified impact via a large series of
SSV-ID:7324[6],which was released in milw0rm.c
fragmented ICMP Echo Request packets to a system with
-om,and elevated privileges to root privileges and kernel
a heavy CPU load,in the Linux kernel through 3.13.6 also.
privileges from the general privileges by exploiting the
special features that ptrace just have the function to
change register when debugging the subprocess. During

226
C. IP Spoofing Vulnerability module and the modules of your server to function should
The fault of the TCP/IP itself causes the TCP/IP stack be compiled into Apache properly [14].
loopholes in many operating systems, Linux is no excepti B. Security problem with SSH
-on. IP spoofing is the creation of Internet Protocol (IP)
packets with a forged source IP address,aims to conceal Secure shell (SSH),a popular service for file transfers,
the identity of the sender or impersonating another securing logins and command execution through a network,
computing system, which exploiting a fact that there is no which is greatly more secure than the ftp, telnet, and
any check for the source IP address of IP packets and a R-command programs although, there have been multiple
forged source IP address from attacker can’t be observed. flaws found. Most of them are minor bugs, but individual
IP address spoofing commonly as a auxiliary method of vulnerabilities are extremely dangerous which allow
other attack, which makes the defense relying on disable attackers to remotely obtain root access on a vulnerable
specific IP lose efficacy. machine. More aecurity issues are caused by the
An attacking client will be disguised as a trusted specifically misconfiguration, mismanagement of SSH,
host and establish the application connection with the and the failure to apply patches and updates timely[14].
target host based on address validation. After succeeds, the It is noteworthy that the openSSL"bleeding heart"
attacker can place a system backdoor for unauthorized 0-day vulnerability(CVE-2014-0160),which is the most
operation. Even more, the system under attack will send a serious vulnerabilities this year and exposed on April 8th,
large number of SYN/ACK packets to who it believes is 2014,may also cause some security problem with SSH
the originator of the connection establishment sequence[12]. which based on open SSL.
In this case, two systems will be damaged: the target Systems affected and Measures: Any UNIX/Linux
system and the system which is really using the spoofed system running Open SSH 3.3 or earlier, SSH Communica
address in the global routing system. -tion Security's SSH 3.0.0 or earlier. Ensure that you are
Moreover, the attacker can manufacture large amounts running the recent version of SSH or Open SSH. Set
of data requests from different bogus IP which are selected privilege configuration for users’ environment properly.
from IP segment the server can provide, and sent them to And set Fall Back To Rsh key to “No” in the SSH
the target computer or system with real IP hiding, which configuration file.SSH services provided by a host must be
will cause a denial of service. In addition, when an adequately protected[14].
unreachable source address used for TCP SYN attack, the C. Security problem with SYSLOG[16]
target host will attempt to reserve resources waiting for a The sysl5ade to the latest package.
response. Additional host resources exhausted with the
forged source address on each new packet sent is D. Security problem with TELNET
repeatedly changed by the attacker [12]. Telnet transfer all the contents of the user, including
To many products of Linux operating system like the user name and password in the form of plaintext over
firewall and IDS, this vulnerability is also fatal. the Internet, which is a security risks. For example, the
Defense against IP spoofing attacks Linux Console on some models of the WAGO I/O System
The main defense against IP spoofing attacks is packet 758 has a default password for the admin and root
filtering:ingress filtering and egress filtering. Ingress accounts, and a default password of guest for the guest
filtering, the gateway to a network usually performs, tries account, a default password of user for the user account,
to prevent an outside attacker spoofing the address of an which allows attackers to gain administrative control
internal machine, and thus indirectly combat various types through the Telnet service of the system leading to a loss
of net abuse by making Internet traffic traceable to its of integrity, confidentiality, or loss of availability
source[12][13]. Egress filtering is just the opposite. (CVE-2012- 4879,CVSS Severity: 10.0 ) [17].
The opinion that designing new network protocols and Measures: Disable Telnet service, with SSH which is
services which do not rely on the IP source address for more secure insteading of.
authentication is also recommended[12].
z From services shipped in Linux E. Security problem with FTP
A. Security problem with Apache The WU-FTPD daemon, a FTP server, shipped with all
versions of Red Hat Linux. When the user running the
Vulnerabilities of apache such like Apache Tomcat, FTPd daemon with root privileges, the vulnerabilities of
Apache Camel and Apache HTTP Server Vulnerabilities wu-ftpd version with Red Hat Linux 6.1 consists of
are commonly exposed through the web server potentially, MAPPING_CHDIR buffer overflow, Message File buffer
which may cause denial of service, web site defacement, overflow and SITE NEWER consumes memory, possibly
information disclosure, privilege escalation and etc. remote and local intruders can execute malicious code
Systems affected and Measures: All UNIX systems even cause the server to consume excessive amounts of
running Apache and many Linux and UNIX variants come memory, preventing normal system operation[16].
with Apache installed. Don’t run Apache as root and set In Red Hat Linux 9,the vsftpd FTP daemon is not
permissions of running Apache. Ensure that you are compiled against TCP wrappers but is installed as a
running the latest patch level and the core OS components standalone service, which inadvertently prevents vsftpd
referenced by Apache are patched. Disable unnecessary

227
from restricting access as intended. Which Provides V. CONCLUSION
unauthorized access, allows partial integrity confidentiality, In this paper, the statistics of vulnerabilities volume
and availability violation; causes disruption of service and over the last 26 years and their distribution in different
unauthorized disclosure of information (CVE-2003-0135). products(top10) and Linux version was presented. Then,
Directory traversal vulnerability in pure-FTPd 1.0.22 we emphatically and systematically discusses the
and possibly other versions, which running on SUSE vulnerabilities which originate from Linux Operating
Linux Enterprise Server and possibly other operating Systems(OS) itself and from some of the services shipped
systems, allows local users to overwrite arbitrary files and in Linux, respectively.And two security enhancements:
gain privileges via unknown vectors, when the Netware hardening and LSM be briefly described and discussed.
OES remote server feature is enabled(CVE-2011-3171, The study of various Linux vulnerabilities in this paper
CVE- 2011-0988). suggests that we still have a long way to go in secureing
measures: Update of related ftp packages. existing OS. Advanced technologies or products in the
There are still many servers such as BIND,SNMP,SSL pursuit of greater security while always bring some new
and etc, shipped in Linux which are commonly probed and security issues inevitably. Therefore, it is necessary to
attacked, Please refer to the report[14] and the paper understand the existing vulnerabilities and the attack
“Linux Securities and Vulnerabilities” [16]for more details. principle to protect existing systems and provide more
IV. LINUX PROTECTIVE MEASURES secure advanced services, and it is which we will keep tabs
on.
Almost all of the Linux vulnerabilities published,
eitherfrom Linux OS itself or from the services shipped in REFERENCES
it,have been fixed by patching or uprating, but it is [1] Linux.http://en.wikipedia.org/wiki/Linux.
necessary to study some protective measures. Linux [2] Younan Y. 25 Years of Vulnerabilities: 1988-2012[J],Sourcefire
security enhancement methodology can be divided into Crop,2013.
two main groups based on OS hardening and on extended [3] Cisco 2014 Annual security report[J],Cisco,2014.
access control[17]. [4] Secunia Vulnerability Review[J],Secunia,2014.
OS Hardening: A process of securing a system by [5] Linux kernel race condition with PTRACE_SETREGS, Openwall,
reducing available vectors of attack typically includes the 2013.http://www.openwall.com/lists/oss-security/2013/02/15/16.
removal of unnecessary software, unnecessary usernames [6] SSV-ID:7324.http://sebug.net/vuldb/ssvid-7324.
or logins and the disabling or removal of unnecessary [7] Morton A, Starzetz P. Linux kernel do_brk function boundary
services to decrease the potential link from the attacker to condition vulnerability[J]. 2003.
the system[18]. Measures of hardening Linux systems, [8] Chen,Haogang,et al.,Linux kernel vulnerabilities: State-of-the-art
which mainly involve applying a patch to the kernel; defenses and open problems.Proceedings of the Second Asia-
closing open network ports; and setting up firewalls, Pacific Workshop on Systems. ACM, 2011.
intrusion-detection/ prevention systems. Besides, [9] http://www.jb51.net/article/3507.htm.
hardening scripts and tools like Bastille Linux and [10] CVE-2014-2523.http://web.nvd.nist.gov/view/vuln/detail?vulnId=
Apache/PHP Hardener can also deactivate unneeded CVE-2014-2523&cid=2.
features in configuration files or perform other protective [11] CVE-2014-0100.http://web.nvd.nist.gov/view/vuln/detail?vulnId=
CVE-2014-0100&cid=2.
measures[18].Beyond all that, Linux tailoring seems to be a
[12] P. Ferguson,D. Senie, Network Ingress Filtering:Defeating Denial
good idea which includes the kernel tailoring and system of Service Attacks which employ IP Source Address Spoofing,
library tailoring. RFC Editor, 2000.
Extended Access Control: The discretionary access [13] Ingress Filtering .http://en.wikipedia.org/wiki/Ingress_filtering.
control(DAC) mechanism of Linux gives users (in a [14] Vulnerabilitie In Linux Environment,Softpanorama. http:// www.
certain group) the same rights, and all processes created by softpanorama.info/Commercial_linuxes/Security/top_vulnerabilies
a user have exactly the same privileges. The acquired .shtml#Introduction
permissions can also be transferred to other subjects, so a [15] http://www.centos.bz/2011/07/secure-linux-apache-web-server-10
flaw in one software can lead to all the users’ data being tips/.
compromised[19].DAC is vulnerable to bypass and [16] Haluk T,Seung Y. Linux Securities and Vulnerabilities,ECE 578
tampering and enhancing the primitive access control Project.
usually requires the kernel to be adjusted to accommodate. [17] R.Wita,Y.Teng-Amnuay.Vulnerability profile for linux.In Proceed
Linux Security Modules (LSM)[20],a frame work that -ings of the 19th International Conference on Advanced Informat
-ion Networking and Applications,pages 953-958. IEEE, 2005.
allows access control models to be implemented as loadab
[18] Hardening.http://en.wikipedia.org/wiki/Hardening_(computing).
-le kernel modules, allows the Linux kernel to support a
[19] Nimbalkar R,Patel P,Meshram B B.Advanced Linux Security,
variety of computer security models while avoiding favori American Journal of Engineering Research (AJER),2013.
-tism toward any single security implementation. Modules
[20] Linux Security Modules. http://en.wikipedia.org/wiki/Linux_
such as AppArmor,SELinux, Smack and TOMOYO Linux Security_Modules.
are currently accepted in the official kernel [20].

228