Linux, September 11, January, with the trigger vulnerability, the Administrator rapidly supplemented ptrace 0day.

Linux has been very bad in the last 30 days. First, the udev Local Elevation of Privilege Vulnerability on April 9, April 20, and then the SCTP remote overflow vulnerability on April 9, April 28. Today, a ptrace_attach Local Elevation of Privilege Vulnerability is coming, or 0 day! No patch!

Su baozi quickly looked at the vulnerability exploitation program. The principle should be to mount it to a suid root program through ptrace, and then execute the command with root permission by exploiting the vulnerability of the ptrace_attach function, generate/tmp /. exp: local root shell. Unfortunately, this exp is slightly problematic. In REDHAT, you need to make a slight modification to get the root permission.

Several temporary solutions are provided for your selection (the following solutions are simplified to difficult ):

1. Disable all common local user accounts until patches are released. This solution cannot prevent hackers with webshell from obtaining root privileges.

2. Disable all system suid root programs until patches are released. This scheme will cause some functions of the system to fail to be used normally.

3. Install sptrace LKM to disable ptrace for common users. This solution has a relatively small impact on the business, but is more complicated to implement.