The Stack Clash vulnerability threatens the Linux world. System patches on the way.
After a short intermission, the digital world is once again facing a major security threat. The so-called Stack Clash vulnerability is threatening major Unix-based OS’s like Linux, FreeBSD and OpenBSD.
We have applied to our web hosting platform all the patches that have been released by the affected OS vendors thus far.
Learn more about the origins of the Stack Clash vulnerability and the attack patterns it uses to endanger systems.
What is the Stack Clash vulnerability all about?
Stack Clash follows the well-known privilege escalation scenario.
At its heart is a longstanding OS flaw that lets attackers elevate their privileges and get root access.
This way, a user could gain control over the processes another user is running on the same server, which is a great concern for web hosting providers.
The vulnerability derives its name from a RAM memory region called the stack. Each program on your PC uses one.
This memory region can increase automatically on demand. However, if it grows too much and gets too close to another memory region, the respective program may confuse the two.
Namely that moment of confusion could be used by an attacker to exploit the given system and overwrite the stack with the other memory region (or vice versa).
The security specialists at Qualys have figured out how such an attack in fact works by locating a series of vulnerabilities.
First, the CVE-2017-1000364 vulnerability can be used to force a given stack to interfere with another one and stir a confusion like the one mentioned above.
Then another security flaw – CVE-2017-1000367, can be combined with the primary Stack Clash vulnerability so as to obtain full root privileges.
The researchers at Qualys have also expressed their concerns about the possibility of a remote vulnerability exploitation, which makes Stack Clash an even more serious issue.
In fact, the history of slack clashes can be traced back to 2005 when they were first discovered by the security researcher Gaël Delalleau.
They were re-discovered 5 years later, which made Linux developers start thinking of a reliable long-term patch for the Slack Clash flaw.
The so-called stack guard-page they introduced was meant to stop a given stack memory region from interfering with other memory processes.
However, attackers seem to have managed to outsmart the guard-page protection measure and break into computer systems during moments of confusion such as the above-described one.
System patches for the Stack Clash vulnerability on the way
The rediscovery of the Stack Clash flaw spread like wildfire across the Internet on Monday, urging the affected distributors and system administrators to take immediate measures to patch things up.
The affected OS vendors started working on bug fixes. Red Hat, for instance, came up with an immediate kernel patch, which may cause performance issues but without a noticeable effect on the normal operations.
Others like the Linux kernel are yet to release patches any moment now.
We’ll be keeping a watch out for any new patches and will keep you posted on all upcoming updates, so stay tuned.
Originally published Thursday, June 22nd, 2017 at 4:10 pm, updated July 8, 2024 and is filed under Web Hosting Platform.Tags: Linux, operating system, online security