Major bug found in Linux kernel

Security researchers have discovered a potentially serious bug in the Linux kernel allowing the elevation of local privileges to root status.

The vulnerability, discovered by Perception Point, potentially affects tens of millions of Linux PCs and servers and 66% of all Android devices.

It involves exploiting a flaw in the keyring facility by deliberately triggering an integer overflow in a key object's usage field and using this to trigger malicious code execution.

At least one major Linux distribution — Debian — has fixed the bug in its packages.

Apple has meanwhile patched nine vulnerabilities in its OS X and iOS operating systems, many of which could potentially be used to execute malicious code with kernel privileges.

One of the patched vulnerabilities was remotely exploitable by malicious web pages, Apple revealed in its patch notes.

The company has also updated its Safari browser to patch six vulnerabilities, including five that may allow malicious sites to trigger the execution of arbitrary code.

Adobe Flash has been meanwhile building notoriety for being a significant threat vector, and recent research indicates that there is a significant issue among Australian PCs with running unpatched and therefore insecure versions of the software.

Flexera Software revealed that around 78% of Australian PCs are running unpatched versions of Adobe Flash, making it the most popular end-of-life program.

But Apple's Quicktime and iTunes were ranked the first and second most exposed programs among Australian PCs when ranked by market share and the percentage of unpatched versions running.

The largest number of vulnerabilities among the most exposed programs was found in Adobe Reader 10.x and 11.x.

Image courtesy of Guilherme Tavares under CC