The formidable presence of Linux among servers and mobile devices automatically places any bug at a higher severity level than an average Windows vulnerability. This brings us to CVE-2016-0728, a bug that managed to stay off the radar for three years, and if properly exploited could provide root access to an attacker, or allow a malicious app to escape its sandbox on Android KitKat or earlier.
When we think about every server running day to day, every Android-based mobile device, and every embedded system like a modem or router, the idea of a bug in Linux becomes much more worrying. Perhaps Linux hasn't quite made it with traditional computers, but outside the desktop, ignoring its relevance would be sheer madness. Needless to say, Linux is a very tempting target, and any zero-day could wreak havoc in the wrong hands. The folks at Perception Point identified one of those zero-days, although the term seems a bit forced, because it has been with us for three years.
The original article (highly technical, I must add) indicates that the bug was identified as CVE-2016-0728. This flaw appeared with version 3.8 of the Linux kernel and affects the so-called keyring facility where encryption keys, tokens of authentication, and other critical security elements are stored. Perception Point researchers reported the vulnerability to the Linux kernel maintainers and also created a proof of concept in which a keyring element stored in memory can be replaced with executable code by the kernel. Although technologies like ASLR can mitigate the impact of the bug and make exploit creation more difficult, the overall risk remains intact.
Perception Point acknowledges that it hasn't seen this bug active on the web (either as a standalone exploit or as part of a "package"), but highlights that millions of Linux computers and servers, along with 66 percent of Android devices, are affected. Google's response was that they already have a patch ready to send to their major partners, however, their calculations show a much smaller number of affected devices. On the other hand, it is estimated that all major distros have already received updates to eliminate this bug at its root. We all agree that Android needs a more direct update model, and every new bug that appears will serve as a reminder.
Perception Point
