Re: milw0rm rootkit

[Alan Cox]

On Mon, 14 Mar 2011 12:28:11 -0700
Justin <wellspring3@xxxxxxxxx> wrote:

> Yes, she runs 2.6.34.8-68.fc13.i686.PAE
> 
> I know this is for the kernel... The C file seems to exploit a
> vulnerability in the kernel, so I thought I should let the kernel
> people know so they could patch it upstream. Right? I know the hacker
> couldnt have gotten in if the security was stronger, but shouldnt the
> kernel be secured against the rootkit?

Firstly 2.6.34 is an old kernel, and we've no idea what other patches and
the like are in the Fedora version. You should ask the Fedora people
about that. Secondly the answer is no - there are various bits of user
space that are privileged and bugs in those can lead to exploitation
without the kernel being involved, particularly if you are not using
security containment setups like SELinux.

You need to talk to the distro.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/