Messages in this thread | | | Date | Mon, 14 Mar 2011 20:12:16 +0000 | From | Alan Cox <> | Subject | Re: milw0rm rootkit |
| |
On Mon, 14 Mar 2011 12:28:11 -0700 Justin <wellspring3@gmail.com> wrote:
> Yes, she runs 2.6.34.8-68.fc13.i686.PAE > > I know this is for the kernel... The C file seems to exploit a > vulnerability in the kernel, so I thought I should let the kernel > people know so they could patch it upstream. Right? I know the hacker > couldnt have gotten in if the security was stronger, but shouldnt the > kernel be secured against the rootkit?
Firstly 2.6.34 is an old kernel, and we've no idea what other patches and the like are in the Fedora version. You should ask the Fedora people about that. Secondly the answer is no - there are various bits of user space that are privileged and bugs in those can lead to exploitation without the kernel being involved, particularly if you are not using security containment setups like SELinux.
You need to talk to the distro.
Alan
| |