Patch now: Linux file system security hole, dubbed Sequoia, can take over systems
Summary
The Qualys Research Team, which uncovered the file system bug, also discovered a size_t-to-int type conversion vulnerability in the Linux kernels filesystem. Then, as Bharat Jogi, Qualys Senior Manager of Vulnerabilities and Signatures, explains, "If an unprivileged local attacker creates, mounts, and deletes a deep directory structure whose total path length exceeds 1GB, and if the attacker open()s and read()s /proc/self/mountinfo, then" through a series of other maneuvers you can write to out of bounds memory. Alas, there are numerous known hacks that use memory overruns to become the root user and grab control of a computer. Eric Sandeen, Red Hats top file system developer, came up with a fix for the problem. So, if youve been sitting on your hands and not updating your Linux computers, its time to get off them and start typing in patching commands.
Classifications
AskAI Classifications
LabelsLinked Companies
