Blog

03/06/2019

How To Patch and Protect Linux Kernel Zero Day Vulnerability CVE-2016-0728 [ 19/Jan/2016 ]



A very serious security problem has been found in the Linux kernel. A 0-day local privilege escalation vulnerability has existed since 2012. This bug affects millions of Android or Linux applications to escalate privileges. Any server or desktop (32 or 64 bit) with Linux Kernel version 3.8+ is vulnerable. How do I fix this problem?

What is CVE-2016-0728 bug?

As per the original research post:

CVE-2016-0728 is caused by a reference leak in the keyrings facility. Before we dive into the details, let’s cover some background required to understand the bug. It can successfully escalates privileges from a local user to root.

A list of affected Linux distros

Is my Linux distro version affected by CVE-2016-0728? The “Possible use-after-free vulnerability in keyring facility, CVE-2016-0728” are as follows:

  1. Red Hat Enterprise Linux 7
  2. CentOS Linux 7
  3. Scientific Linux 7
  4. Debian Linux stable 8.x (jessie)
  5. Debian Linux testing 9.x (stretch)
  6. SUSE Linux Enterprise Desktop 12
  7. SUSE Linux Enterprise Desktop 12 SP1
  8. SUSE Linux Enterprise Server 12
  9. SUSE Linux Enterprise Server 12 SP1
  10. SUSE Linux Enterprise Workstation Extension 12
  11. SUSE Linux Enterprise Workstation Extension 12 SP1
  12. Ubuntu Linux 14.04 LTS (Trusty Tahr)
  13. Ubuntu Linux 15.04 (Vivid Vervet)
  14. Ubuntu Linux 15.10 (Wily Werewolf)
  15. Opensuse Linux LEAP 42.x and version 13.x
  16. Oracle Linux 7

How do I fix CVE-2016-0728 on Linux?

Type the commands as per your Linux distro. You need to reboot the box. Before you apply patch, note down your current kernel version:
$ uname -a
$ uname -mrs

Sample outputs:

Linux 3.13.0-74-generic x86_64

Debian or Ubuntu Linux

$ sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist-upgrade
Sample outputs:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages were automatically installed and are no longer required:
  git-man liberror-perl
Use 'apt-get autoremove' to remove them.
The following NEW packages will be installed:
  linux-headers-3.13.0-76 linux-headers-3.13.0-76-generic
  linux-image-3.13.0-76-generic linux-image-extra-3.13.0-76-generic
The following packages will be upgraded:
  linux-generic linux-headers-generic linux-image-generic
3 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 61.6 MB of archives.
After this operation, 271 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://security.ubuntu.com/ubuntu/ trusty-security/main linux-image-3.13.0-76-generic amd64 3.13.0-76.120 [15.2 MB]
Get:2 http://security.ubuntu.com/ubuntu/ trusty-security/main linux-image-extra-3.13.0-76-generic amd64 3.13.0-76.120 [36.8 MB]
Get:3 http://security.ubuntu.com/ubuntu/ trusty-security/main linux-generic amd64 3.13.0.76.82 [1,780 B]
....
...
.....
Setting up linux-image-extra-3.13.0-76-generic (3.13.0-76.120) ...
run-parts: executing /etc/kernel/postinst.d/apt-auto-removal 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
run-parts: executing /etc/kernel/postinst.d/dkms 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
run-parts: executing /etc/kernel/postinst.d/initramfs-tools 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
update-initramfs: Generating /boot/initrd.img-3.13.0-76-generic
run-parts: executing /etc/kernel/postinst.d/zz-update-grub 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-3.13.0-76-generic
Found initrd image: /boot/initrd.img-3.13.0-76-generic
Found linux image: /boot/vmlinuz-3.13.0-74-generic
Found initrd image: /boot/initrd.img-3.13.0-74-generic
  No volume groups found
done
Setting up linux-image-generic (3.13.0.76.82) ...
Setting up linux-headers-3.13.0-76 (3.13.0-76.120) ...
Setting up linux-headers-3.13.0-76-generic (3.13.0-76.120) ...
Examining /etc/kernel/header_postinst.d.
run-parts: executing /etc/kernel/header_postinst.d/dkms 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
Setting up linux-headers-generic (3.13.0.76.82) ...
Setting up linux-generic (3.13.0.76.82) ...

Reboot the server:
$ sudo reboot

RHEL / CentOS Linux

$ sudo yum update
$ sudo reboot

Sample outputs:

Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: centos.excellmedia.net
 * epel: mirrors.hustunique.com
 * extras: centos.excellmedia.net
 * updates: centos.excellmedia.net
Resolving Dependencies
--> Running transaction check
---> Package kernel.x86_64 0:3.10.0-327.4.5.el7 will be installed
---> Package kernel-devel.x86_64 0:3.10.0-327.4.5.el7 will be installed
---> Package kernel-headers.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package kernel-headers.x86_64 0:3.10.0-327.4.5.el7 will be an update
---> Package kernel-tools.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package kernel-tools.x86_64 0:3.10.0-327.4.5.el7 will be an update
---> Package kernel-tools-libs.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package kernel-tools-libs.x86_64 0:3.10.0-327.4.5.el7 will be an update
---> Package ntp.x86_64 0:4.2.6p5-22.el7.centos will be updated
---> Package ntp.x86_64 0:4.2.6p5-22.el7.centos.1 will be an update
---> Package ntpdate.x86_64 0:4.2.6p5-22.el7.centos will be updated
---> Package ntpdate.x86_64 0:4.2.6p5-22.el7.centos.1 will be an update
---> Package python-perf.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package python-perf.x86_64 0:3.10.0-327.4.5.el7 will be an update
--> Finished Dependency Resolution
--> Running transaction check
---> Package kernel.x86_64 0:3.10.0-229.11.1.el7 will be erased
---> Package kernel-devel.x86_64 0:3.10.0-229.11.1.el7 will be erased
--> Finished Dependency Resolution
 
Dependencies Resolved
 
======================================================================
 Package            Arch    Version                   Repository
                                                                 Size
======================================================================
Installing:
 kernel             x86_64  3.10.0-327.4.5.el7        updates    33 M
 kernel-devel       x86_64  3.10.0-327.4.5.el7        updates    11 M
Updating:
 kernel-headers     x86_64  3.10.0-327.4.5.el7        updates   3.2 M
 kernel-tools       x86_64  3.10.0-327.4.5.el7        updates   2.4 M
 kernel-tools-libs  x86_64  3.10.0-327.4.5.el7        updates   2.3 M
 ntp                x86_64  4.2.6p5-22.el7.centos.1   updates   543 k
 ntpdate            x86_64  4.2.6p5-22.el7.centos.1   updates    84 k
 python-perf        x86_64  3.10.0-327.4.5.el7        updates   2.4 M
Removing:
 kernel             x86_64  3.10.0-229.11.1.el7       @updates  131 M
 kernel-devel       x86_64  3.10.0-229.11.1.el7       @updates   32 M
 
Transaction Summary
======================================================================
Install  2 Packages
Upgrade  6 Packages
Remove   2 Packages
 
Total download size: 55 M
Is this ok [y/d/N]: y
Downloading packages:
Delta RPMs reduced 11 M of updates to 4.6 M (57% saved)
(1/8): kernel-headers-3.10.0-327.4.5.el7.x86_64. | 3.2 MB   00:17     
(2/8): ntp-4.2.6p5-22.el7.centos.1.x86_64.rpm    | 543 kB   00:03     
(3/8): ntpdate-4.2.6p5-22.el7.centos.1.x86_64.rp |  84 kB   00:00   
...
...
....
Installed:
  kernel.x86_64 0:3.10.0-327.4.5.el7                                  
  kernel-devel.x86_64 0:3.10.0-327.4.5.el7                            
 
Updated:
  kernel-headers.x86_64 0:3.10.0-327.4.5.el7                          
  kernel-tools.x86_64 0:3.10.0-327.4.5.el7                            
  kernel-tools-libs.x86_64 0:3.10.0-327.4.5.el7                       
  ntp.x86_64 0:4.2.6p5-22.el7.centos.1                                
  ntpdate.x86_64 0:4.2.6p5-22.el7.centos.1                            
  python-perf.x86_64 0:3.10.0-327.4.5.el7                             
 
Complete!

Suse Enterprise Linux or Opensuse Linux

To apply all needed patches to the system type:
# zypper patch
# reboot

Or version specific info:

SUSE Linux Enterprise Workstation Extension 12-SP1

# zypper in -t patch SUSE-SLE-WE-12-SP1-2016-124=1

USE Linux Enterprise Software Development Kit 12-SP1

# zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-124=1

SUSE Linux Enterprise Server 12-SP1

# zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-124=1

SUSE Linux Enterprise Module for Public Cloud 12

# zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2016-124=1

SUSE Linux Enterprise Live Patching 12

# zypper in -t patch SUSE-SLE-Live-Patching-12-2016-124=1

SUSE Linux Enterprise Desktop 12-SP1

# zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-124=1
To bring your system up-to-date, run
# zypper patch && reboot

Verification

You need to make sure your version number changed:
$ uname -a
$ uname -r
$ uname -mrs

The version of the kernel a system is running can be confirmed with the uname command. A list of bug fixed kernel version is as follows:

  • Ubuntu Linux 14.04 LTS : 3.13.0-76 (package version 3.13.0-76.120)
  • Debian Linux 8.x : 3.16.0-4 (package version 3.16.7-ckt20-1+deb8u3)
  • SUSE Linux Enterprise Server 12 SP1 : 3.12.51-60.25.1
  • RHEL 7 : 3.10.0-327.4.5.el7.x86_64
  • CentOS 7 : Same as RHEL 7.

Trying out exploit code

You can try proof-of-concept code to find out if your kernel is secure or not. Use the wget command to grab the sample code:
$ wget https://gist.githubusercontent.com/PerceptionPointTeam/18b1e86d1c0f8531ff8f/raw/5a90e6f98de85f35708087620de73bed3bf16880/cve_2016_0728.c
Compile it as follows (make sure you install the gcc compiler and keyutils developers libraries):
$ gcc cve_2016_0728.c -o cve_2016_0728 -lkeyutils -Wall
Run it as follows:
$ ./cve_2016_0728 PP_KEY
The full exploit which runs on kernel, takes about 30 minutes to run on Intel Core i7-5500 CPU:

Fig.01: CVE-2016-0728 point of concept exploit code

However, on patched system the exploit will fail:
CentOS 7.2: Exploit code failed.

References

Posted by: SXI ADMIN

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

20/08/2019

Start your Bitcoin Exchange with our Software

Start your Bitcoin Exchange with our Software Setup your white label bitcoin exchange right away. Or create your own cryptocurrency using...
14/08/2019

How to KVM, QEMU start or stop virtual machine from command line (CLI)

KVM or Kernel Based Virtual Machine is a popular virtualization technology. It allows you to run virtual guest machines over a host machine. To start...
14/08/2019

How to Docker backup Saving and restoring your volumes

Running a Docker volume backup First, we spin up a temporary container, and we mount the backup folder and the target Docker volume to this container....