New Linux 'Mutagen Astronomy' security flaw impacts Red Hat and CentOS distros

[steven36]

Red Hat team provides mitigations, promises kernel updates.

 

 

A cyber-security firm has gone public with details and proof-of-concept (PoC) code about a vulnerability in the Linux kernel that currently impacts only CentOS and Red Hat Enterprise Linux (RHEL) distributions.

 

The vulnerability's name is Mutagen Astronomy and is tracked as CVE-2018-14634. Discovered by the team at the Qualys Research Labs, this security flaw is categorized as a Local Privilege Escalation (LPE) issue.

This is a type of vulnerability that requires an attacker to have a foothold on a vulnerable system, but it's one of those security flaws that can turn a simple hack into a very bad one, as it can be used to give an intruder root access and complete control over infected systems.

 

According to Qualys researchers, the actual bug resides in the create_elf_tables() function of the Linux kernel, where a cleverly crafted exploit can cause a buffer overflow that executes malicious code with root privileges.

 

The vulnerability was present in the Linux kernel between July 19, 2007 (kernel commit: b6a2fea39318) and July 7, 2017 (kernel commit: da029c11e6b1).

 

"Even though all Linux kernels are technically vulnerable, this issue is mitigated by a one-year-old patch that was backported to most long-term kernels and makes exploitation impossible," a Qualys spokesperson told ZDNet today.

 

 

"However, Red Hat Enterprise Linux and CentOS have not backported this patch, and are therefore vulnerable and exploitable," the spokesperson added.

 

In a statement posted today, the Red Hat team confirmed this issue.

 

"This issue affects the version of the kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 will address this issue," the Red Hat team said.

 

Until a patch will be ready, the Red Hat security team posted basic mitigation advice on how to protect vulnerable systems until a patch would be out.

 

Seeing that a patch for this issue already exists and was backported by most distros, CentOS and Red Hat should have updates to address this issue in older OS versions in the coming days.

Qualys researchers have published a detailed write-up of the weirdly named Mutagen Astronomy vulnerability, along with two PoCs [1, 2].

 

Source