Ancient memory handling flaw haunts BSD, Linux

Admins are advised to patch their operating system installations against a decade-long memory management flaw that can be exploited to escalate user privileges to root superuser, potentially leading to a full system takeover.

Security vendor Qualys published an advisory and wrote proofs-of-concept for the vulnerability, dubbed Stack Clash, which stems from an insufficiently robust memory management protection implementation in modern operating systems.

The stack is an area of memory used by computer programs to store data during execution. It can expand and contract automatically, depending on the needs of the running code. 

Attackers can exploit this to grow an application's stack to collide or clash with nearby memory regions and overwrite the content.

While Stack Clash requires local access for exploitation, Qualys said it can be combined with other vulnerabilities to perform attacks. There is also a theoretical possibility of remote exploitation of Stack Clash via specific applications, although the one test case Qualys went through "turned out to be unexploitable by sheer luck," the security vendor said.

Qualys found that the UNIX-like FreeBSD, OpenBSD, NetBSD and Solaris operating systems along with Linux were vulnerable to Stack Clash. 

Linux distributions and the BSD operating system maintainers are releasing patches for Stack Clash.

As a workaround, admins can reboot systems or manually apply stack limits to local users' applications.

However Qualys warned that this could lead to some programs falling over, and recommended systems be updated as soon as possible instead.

The vulnerability has been observed since 2004, and protection mechanisms were developed by open source coders in the following years.

However, Qualys' research showed that the protection mechanisms are inadequate to prevent attackers with user access to systems from exploiting the vulnerability.

The company believes other operating systems such as Windows, Apple's OS X/macOS and Google's Linux-based Android could also be vulnerable but is yet to conduct research on them.