Researcher writes codeless exploit that bypasses Linux security measures

best linux distros
Spectral-Design/Shutterstock
If you’re a Linux administrator, then you’re likely aware that even being fully up to date on all of the patches for your Linux distribution of choice is no guarantee that you’re free from vulnerabilities. Linux is made up of numerous components, any of which can open up an installation to one exploit or another.

Such is the case with an exploit that was recently released by security researcher Chis Evans. Although the exploit is quite well-written and uses some unusual methods to exploit a memory corruption vulnerability in GStreamer, it is of primarily academic interest, Ars Technica reports.

The exploit attacks two security protections built into Linux, address space layout randomization (ASLR) and data execution protection (DEP). DEP is meant to block an exploit’s ability to load into memory and is otherwise known as NX or No-Execute, while ASLR is meant to randomize where code loads into memory and thus limit then exploit’s impact on a system to a crash rather than compromise.

The exploit, which is written specifically for Linux distribution Fedora, does not use actual code to exploit the Gstreamer framework. Rather, it bypasses the protections with carefully written code that is arranged in such a way as to essentially disable ASLR and DEP. As Evans said about his code in a blog post, “This was a fairly ridiculous exploit. But it was worth doing because it’s proof that scriptless exploits are possible, even within the context of decent 64-bit ASLR. It was possible to commandeer memory reads, writes and even additions within the decoder loop to slowly but surely advance the exploit and gain control.”

The following screenshot demonstrates how Fedora can be commandeered using the exploit:

chris-evans-linux-exploit
Chris Evans
Chris Evans

Evans released his code as a FLAC media file supported by Fedora version 24, and exploits the GStreamer vulnerability and also attacks Rhythmbox and Totem media players. Because it’s written specifically for Fedora and would specifically only threaten the relatively small number of Linux users who play media on the platform, it doesn’t pose a threat to any other Linux distributions or to the community at large.

Researchers create these kinds exploits to help move the state of Linux security forward. By demonstrating how an exploit can be written to work around just about any vulnerability, exploits like this one highlight the need for Linux vendors to actively improve Linux security rather than merely reacting to threats as they arise.

Photography

Forget painting-style transfers, this A.I. creates realistic portraits of fake people

Do these images look computer-generated? Nvidia researchers recently published a paper on a new variation on style transfer artificial intelligence that's able to generate entirely new portraits.
Gaming

With our Steam guide, you can give the gift of gaming this holiday season

The holidays may have passed, but it's always a good time to give the gift of gaming (especially when there's a Steam sale)! Here's our quick guide on how to give a Steam game as a gift.
Movies & TV

Stay inside this winter with the best shows on Hulu, including 'Killing Eve'

It's often overwhelming to navigate Hulu's robust library of TV shows. To help, we put together a list of the best shows on Hulu, whether you're into frenetic cartoons, intelligent dramas, or anything in between.
Movies & TV

The best shows on Netflix, from 'Haunting of Hill House’ to ‘Twilight Zone’

Looking for a new show to binge? Lucky for you, we've curated a list of the best shows on Netflix, whether you're a fan of outlandish anime, dramatic period pieces, or shows that leave you questioning what lies beyond.
Wearables

Our favorite fitness trackers make it fun to keep moving

Looking for your first fitness tracker, or an upgrade to the one you're already wearing? There are plenty of the wrist-worn gadgets available. Here are our picks for the best fitness trackers available right now.
Computing

Leaked HP laptop listing reveals entry-level Nvidia MX250 GPU

Alongside powerful graphics cards, Nvidia may have more mobile GPUs to show off at next year's CES show in January. The MX250 has been spotted in a listing for an HP laptop, potentially replacing the entry-level MX150.
Computing

ZSpace’s laptop brings education to life with its own 3D technology

The ZSpace laptop wants to overhaul education and training by offering affordable access to 3D mixed reality through a bespoke screen and glasses technology that is already supported by a wide array of applications.
Computing

Former Microsoft intern claims Google may have sabotaged Edge browser

Google's Chrome web browser has been able to establish such dominance that Microsoft is abandoning its web rendering engine, switching Edge over to Chromium, but did Google play dirty in an attempt to force Microsoft to make the decision?
Computing

ViewSonic’s 1080p gaming monitor lets you experience the action in style

ViewSonic is catering to gamers with its latest monitor, the XG240R. Featuring a 1080p 144Hz panel, RGB lighting, and a fast 1ms response time, you can conquer your opponents and do it in style.
Computing

Here’s why you might still be using Wi-Fi after cellular 5G launches

Cellular 5G might be around the corner and promising to deliver lightning fast speeds, but the folks over at the Wi-Fi Alliance have a few reasons why they think you shouldn't dump Wi-Fi just yet.
Computing

Pinning websites to your taskbar is as easy as following these quick steps

Would you like to know how to pin a website to the taskbar in Windows 10 in order to use browser links like apps? Whichever browser you're using, it's easier than you might think. Here's how to get it done.
Computing

Detangle your desk with a mighty wireless mouse. Here are our six favorites

If you're looking for the best wireless mouse on the market, we've got the list for you!. These six models have something for everyone, whether you're a hardcore gamer or simply looking to ward off carpal tunnel.
Web

Canceling Amazon Prime is easy, and you might get a refund

Don't be intimidated. Learning how to cancel Amazon Prime is easier than you might think. You might even get a partial or full refund on the cost, depending on how much you've used it. Check out our quick-hit guide for doing so.
Computing

Convert your PDFs into convenient Word documents

PDF files are great, but few document types are as malleable as those specific to Microsoft Word. Here's how to convert a PDF file into a Word document, whether you prefer to use Adobe's software suite or a freemium alternative.