How To Patch and Protect Linux Kernel Zero Day Vulnerability CVE-2016-0728 [ 19/Jan/2016 ]

Posted on in Categories , , , , , last updated February 18, 2016

A very serious security problem has been found in the Linux kernel. A 0-day local privilege escalation vulnerability has existed since 2012. This bug affects millions of Android or Linux applications to escalate privileges. Any server or desktop (32 or 64 bit) with Linux Kernel version 3.8+ is vulnerable. How do I fix this problem?

What is CVE-2016-0728 bug?

As per the original research post:

CVE-2016-0728 is caused by a reference leak in the keyrings facility. Before we dive into the details, let’s cover some background required to understand the bug. It can successfully escalates privileges from a local user to root.

A list of affected Linux distros

Is my Linux distro version affected by CVE-2016-0728? The “Possible use-after-free vulnerability in keyring facility, CVE-2016-0728” are as follows:

  1. Red Hat Enterprise Linux 7
  2. CentOS Linux 7
  3. Scientific Linux 7
  4. Debian Linux stable 8.x (jessie)
  5. Debian Linux testing 9.x (stretch)
  6. SUSE Linux Enterprise Desktop 12
  7. SUSE Linux Enterprise Desktop 12 SP1
  8. SUSE Linux Enterprise Server 12
  9. SUSE Linux Enterprise Server 12 SP1
  10. SUSE Linux Enterprise Workstation Extension 12
  11. SUSE Linux Enterprise Workstation Extension 12 SP1
  12. Ubuntu Linux 14.04 LTS (Trusty Tahr)
  13. Ubuntu Linux 15.04 (Vivid Vervet)
  14. Ubuntu Linux 15.10 (Wily Werewolf)
  15. Opensuse Linux LEAP 42.x and version 13.x
  16. Oracle Linux 7

How do I fix CVE-2016-0728 on Linux?

Type the commands as per your Linux distro. You need to reboot the box. Before you apply patch, note down your current kernel version:
$ uname -a
$ uname -mrs
Sample outputs:

Linux 3.13.0-74-generic x86_64

Debian or Ubuntu Linux

$ sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist-upgrade
Sample outputs:

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages were automatically installed and are no longer required:
  git-man liberror-perl
Use 'apt-get autoremove' to remove them.
The following NEW packages will be installed:
  linux-headers-3.13.0-76 linux-headers-3.13.0-76-generic
  linux-image-3.13.0-76-generic linux-image-extra-3.13.0-76-generic
The following packages will be upgraded:
  linux-generic linux-headers-generic linux-image-generic
3 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 61.6 MB of archives.
After this operation, 271 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://security.ubuntu.com/ubuntu/ trusty-security/main linux-image-3.13.0-76-generic amd64 3.13.0-76.120 [15.2 MB]
Get:2 http://security.ubuntu.com/ubuntu/ trusty-security/main linux-image-extra-3.13.0-76-generic amd64 3.13.0-76.120 [36.8 MB]
Get:3 http://security.ubuntu.com/ubuntu/ trusty-security/main linux-generic amd64 3.13.0.76.82 [1,780 B]
....
...
.....
Setting up linux-image-extra-3.13.0-76-generic (3.13.0-76.120) ...
run-parts: executing /etc/kernel/postinst.d/apt-auto-removal 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
run-parts: executing /etc/kernel/postinst.d/dkms 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
run-parts: executing /etc/kernel/postinst.d/initramfs-tools 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
update-initramfs: Generating /boot/initrd.img-3.13.0-76-generic
run-parts: executing /etc/kernel/postinst.d/zz-update-grub 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-3.13.0-76-generic
Found initrd image: /boot/initrd.img-3.13.0-76-generic
Found linux image: /boot/vmlinuz-3.13.0-74-generic
Found initrd image: /boot/initrd.img-3.13.0-74-generic
  No volume groups found
done
Setting up linux-image-generic (3.13.0.76.82) ...
Setting up linux-headers-3.13.0-76 (3.13.0-76.120) ...
Setting up linux-headers-3.13.0-76-generic (3.13.0-76.120) ...
Examining /etc/kernel/header_postinst.d.
run-parts: executing /etc/kernel/header_postinst.d/dkms 3.13.0-76-generic /boot/vmlinuz-3.13.0-76-generic
Setting up linux-headers-generic (3.13.0.76.82) ...
Setting up linux-generic (3.13.0.76.82) ...

Reboot the server:
$ sudo reboot

RHEL / CentOS Linux

$ sudo yum update
$ sudo reboot
Sample outputs:

Loaded plugins: fastestmirror, langpacks
Loading mirror speeds from cached hostfile
 * base: centos.excellmedia.net
 * epel: mirrors.hustunique.com
 * extras: centos.excellmedia.net
 * updates: centos.excellmedia.net
Resolving Dependencies
--> Running transaction check
---> Package kernel.x86_64 0:3.10.0-327.4.5.el7 will be installed
---> Package kernel-devel.x86_64 0:3.10.0-327.4.5.el7 will be installed
---> Package kernel-headers.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package kernel-headers.x86_64 0:3.10.0-327.4.5.el7 will be an update
---> Package kernel-tools.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package kernel-tools.x86_64 0:3.10.0-327.4.5.el7 will be an update
---> Package kernel-tools-libs.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package kernel-tools-libs.x86_64 0:3.10.0-327.4.5.el7 will be an update
---> Package ntp.x86_64 0:4.2.6p5-22.el7.centos will be updated
---> Package ntp.x86_64 0:4.2.6p5-22.el7.centos.1 will be an update
---> Package ntpdate.x86_64 0:4.2.6p5-22.el7.centos will be updated
---> Package ntpdate.x86_64 0:4.2.6p5-22.el7.centos.1 will be an update
---> Package python-perf.x86_64 0:3.10.0-327.4.4.el7 will be updated
---> Package python-perf.x86_64 0:3.10.0-327.4.5.el7 will be an update
--> Finished Dependency Resolution
--> Running transaction check
---> Package kernel.x86_64 0:3.10.0-229.11.1.el7 will be erased
---> Package kernel-devel.x86_64 0:3.10.0-229.11.1.el7 will be erased
--> Finished Dependency Resolution
 
Dependencies Resolved
 
======================================================================
 Package            Arch    Version                   Repository
                                                                 Size
======================================================================
Installing:
 kernel             x86_64  3.10.0-327.4.5.el7        updates    33 M
 kernel-devel       x86_64  3.10.0-327.4.5.el7        updates    11 M
Updating:
 kernel-headers     x86_64  3.10.0-327.4.5.el7        updates   3.2 M
 kernel-tools       x86_64  3.10.0-327.4.5.el7        updates   2.4 M
 kernel-tools-libs  x86_64  3.10.0-327.4.5.el7        updates   2.3 M
 ntp                x86_64  4.2.6p5-22.el7.centos.1   updates   543 k
 ntpdate            x86_64  4.2.6p5-22.el7.centos.1   updates    84 k
 python-perf        x86_64  3.10.0-327.4.5.el7        updates   2.4 M
Removing:
 kernel             x86_64  3.10.0-229.11.1.el7       @updates  131 M
 kernel-devel       x86_64  3.10.0-229.11.1.el7       @updates   32 M
 
Transaction Summary
======================================================================
Install  2 Packages
Upgrade  6 Packages
Remove   2 Packages
 
Total download size: 55 M
Is this ok [y/d/N]: y
Downloading packages:
Delta RPMs reduced 11 M of updates to 4.6 M (57% saved)
(1/8): kernel-headers-3.10.0-327.4.5.el7.x86_64. | 3.2 MB   00:17     
(2/8): ntp-4.2.6p5-22.el7.centos.1.x86_64.rpm    | 543 kB   00:03     
(3/8): ntpdate-4.2.6p5-22.el7.centos.1.x86_64.rp |  84 kB   00:00   
...
...
....
Installed:
  kernel.x86_64 0:3.10.0-327.4.5.el7                                  
  kernel-devel.x86_64 0:3.10.0-327.4.5.el7                            
 
Updated:
  kernel-headers.x86_64 0:3.10.0-327.4.5.el7                          
  kernel-tools.x86_64 0:3.10.0-327.4.5.el7                            
  kernel-tools-libs.x86_64 0:3.10.0-327.4.5.el7                       
  ntp.x86_64 0:4.2.6p5-22.el7.centos.1                                
  ntpdate.x86_64 0:4.2.6p5-22.el7.centos.1                            
  python-perf.x86_64 0:3.10.0-327.4.5.el7                             
 
Complete!

Suse Enterprise Linux or Opensuse Linux

To apply all needed patches to the system type:
# zypper patch
# reboot
Or version specific info:

SUSE Linux Enterprise Workstation Extension 12-SP1

# zypper in -t patch SUSE-SLE-WE-12-SP1-2016-124=1

USE Linux Enterprise Software Development Kit 12-SP1

# zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-124=1

SUSE Linux Enterprise Server 12-SP1

# zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-124=1

SUSE Linux Enterprise Module for Public Cloud 12

# zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2016-124=1

SUSE Linux Enterprise Live Patching 12

# zypper in -t patch SUSE-SLE-Live-Patching-12-2016-124=1

SUSE Linux Enterprise Desktop 12-SP1

# zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-124=1
To bring your system up-to-date, run
# zypper patch && reboot

Verification

You need to make sure your version number changed:
$ uname -a
$ uname -r
$ uname -mrs
The version of the kernel a system is running can be confirmed with the uname command. A list of bug fixed kernel version is as follows:

  • Ubuntu Linux 14.04 LTS : 3.13.0-76 (package version 3.13.0-76.120)
  • Debian Linux 8.x : 3.16.0-4 (package version 3.16.7-ckt20-1+deb8u3)
  • SUSE Linux Enterprise Server 12 SP1 : 3.12.51-60.25.1
  • RHEL 7 : 3.10.0-327.4.5.el7.x86_64
  • CentOS 7 : Same as RHEL 7.

Trying out exploit code

You can try proof-of-concept code to find out if your kernel is secure or not. Use the wget command to grab the sample code:
$ wget https://gist.githubusercontent.com/PerceptionPointTeam/18b1e86d1c0f8531ff8f/raw/5a90e6f98de85f35708087620de73bed3bf16880/cve_2016_0728.c
Compile it as follows (make sure you install the gcc compiler and keyutils developers libraries):
$ gcc cve_2016_0728.c -o cve_2016_0728 -lkeyutils -Wall
Run it as follows:
$ ./cve_2016_0728 PP_KEY
The full exploit which runs on kernel, takes about 30 minutes to run on Intel Core i7-5500 CPU:

Fig.01: CVE-2016-0728 point of concept exploit code
Fig.01: CVE-2016-0728 point of concept exploit code

However, on patched system the exploit will fail:
CentOS 7.2: Exploit code failed.
CentOS 7.2: Exploit code failed.

References

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin and a trainer for the Linux operating system/Unix shell scripting. He has worked with global clients and in various industries, including IT, education, defense and space research, and the nonprofit sector. Follow him on Twitter, Facebook, Google+.

Share this on (or read 31 comments/add one below):

31 comment

    1. Not likely. The vulnerability was discovered by Perception Point, and did not just appear live already in use. Today’s announcement almost certainly follows on the heels of a disclosure process that started 2 weeks ago. Critical vendors and operators have probably been patched for a while now.

      Reply Report comment

    2. local exploit, so if you have a “linux system exposed on the public” does not necessarily mean a high probability..

      The attacker would need a local account first, so hopefully you’ve kept up on your other safe computing practices (security updates applied in reasonable time, firewalls/acls, etc)

      Reply Report comment

  8. Debian’s “dist-upgrade” command miss “sudo” that actually updating kernel

    Change
    sudo apt-get update && sudo apt-get upgrade && apt-get dist-upgrade
    to
    sudo apt-get update && sudo apt-get upgrade && sudo apt-get dist-upgrade

    Reply Report comment

  9. I have a couple of comments/questions;
    Question 1: As BradErz asked, what kernel version are we looking for that has been patched?
    Question 2: If this vulnerability has been around for 3 years, why is CentOS 7 affected while CentOS 6 is not? Just curious.

    Reply Report comment

  10. The Ubuntu system I built had the kernel version 3.16.0-40, and it was updated to 3.19.
    So was 3.16-040 actually vulnerable in the first place?
    The document says to update it to 3.13.0-76, so anything above that specific version should be good, right?
    Is there something we can run to verify if the vulnerability is still there?

    Reply Report comment

  11. Hi.in RHEL / CentOS Linux section you said that :”The package will be released soon on both CentOS and RHEL 7″
    this means we cant patch this bug with sudo yum update and sudo reboot commands?

    Reply Report comment

            1. You are right. It is fixed in 3.10.0-327.4.5.el7.x86_64. I just verified it:

              rpm -q --changelog kernel | grep -i cve-2016
- [security] keys: Fix keyring ref leak in join_session_keyring() (David Howells) [1298931 1298036] {CVE-2016-0728}

              The page has been updated. Thanks!

              Reply Report comment

Leave a Comment

Tagged as: Tags ,