Linux
vmsplice()Root Exploit
On Saturday February 10th, 2008, a new public exploit was released that utilizeed a similar flaw in vmsplice (vmsplice_to_pipe function) which allows a local user to gain root privileges. This exploit affects Linux kernels v2.6.17 and higher.
vmsplice exploit code is available at: http://www.securityfocus.com/bid/27704/exploit
Once an attacker runs the code and gains root privilages, he/she will then be able to read and write to arbitrary memory locations on affected servers.
How can I discover if my system is vulnerable?
SSH to the server
and run the following command:
/bin/grep -ri vmsplice /boot/System.map-$(uname -r)
If the system returns no results/nothing, that means your system is NOT vulnerable. If the system returns something like:
that means your system is vulnerable.
Solution:
Many Linux distributions reported this bug and provided the following patches for their respective systems:
Ubuntu
https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.22/+bug/190587
Debian
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464953#14
CentOS
http://bugs.centos.org/view.php?id=2667
RedHat
https://bugzilla.redhat.com/show_bug.cgi?id=432251
Gentoo
https://bugs.gentoo.org/show_bug.cgi?id=209460