Stay Ahead With Linux Security Features
security advisory attack A Linux server gets cleaned up after an intrusion. The suspicious process is terminated, credentials are rotated, and the system is rebooted during maintenance. Everything seems secure. A few hours later, the same outbound connection appears again. . Situations like that point to persistence . The attacker no longer needs the original exploit because something on the host continues restoring access behind the scenes. Finding that mechanism is often more important than understanding how the...
Jun 08, 2026
threat detection scalability Building a SIEM is easier than scaling one. Most open-source deployments start as a simple "all-in-one" server. It is easy to set up, but that design rarely survives the transition from a lab to a production workload. . A SIEM watching 20 endpoints is not doing the same job as one watching 500. More endpoints mean more logs; more logs require more storage; more storage makes search heavier. Eventually, the very architecture that made your lab easy to deploy becomes the reason your production...
Jun 04, 2026
security advisory apache A newly disclosed attack technique called HTTP/2 Bomb is drawing attention because it targets the software that sits at the front of much of the Linux internet. Apache HTTP Server, NGINX, Envoy, and the ingress layers that many Kubernetes environments depend on can be forced into consuming disproportionate amounts of memory using relatively small amounts of attacker traffic. . For Linux administrators, the concern is not the HTTP/2 protocol itself. It is the possibility that a single...
Jun 04, 2026
security advisory important The compromise of Nx Console shows how much infrastructure now sits behind a single developer account. GitHub repositories, CI/CD pipelines, container build systems, Terraform projects, Kubernetes deployments. None of those systems was the initial target. The workstation was. . Attackers did not need a Linux privilege escalation bug or a remote code execution chain. They needed developers to trust a tool they were already using. For many organizations, that was enough. What Happened? Federal...
Jun 03, 2026
security advisory open-source You remove the malware. You rotate the compromised credentials. You patch the original vulnerability and close the ticket. Two weeks later, the attacker is back. . What happened? You didn't lose the battle at the exploit; you lost it at the cleanup. In many modern Linux intrusions, the malware you found wasn't the main problem—it was the fallback mechanisms left behind. These hooks quietly restore attacker access the moment you look away. If you clean a host but miss these persistence layers,...
Jun 02, 2026
Refine features
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security features
We found 0 articles for you...
102
security advisorycriticaldata breachSquid: Critical Advisory For 9.8 Threats And DDoS Attacks
Security professionals have discovered various cybersecurity vulnerabilities in the popular Squid caching proxy. These network security issues include request and response smuggling in HTTP/1.1 and ICAP ( CVE-2023-46846 ), Distributed Denial of Service (DDoS) in HTTP Digest Authentication ( CVE-2023-46847 ), and DDoS in FTP ( CVE-2023-46848 ). . Let's review these vulnerabilities and how to boost data and network security to combat these risks. How Can These Cybersecurity Vulnerabilities Affect My Linux Systems? These bugs can compromise sensitive data, crash servers, and harm your company's reputation. CVE-2023-46846 and CVE-2023-46847 have a National Vulnerability Database base score of 9.8 out of 10 since they can lead to cloud security breaches and other system access instabilities and blockings. What Should I Do to Protect My Linux Systems? Squid plans to mitigate these dangerous cybersecurity vulnerabilities with recent critical updates that should reduce the threat landscape for users. Systems that face attacks in network security must go through immediate privacy sandboxing and security patching to prevent new issues from arising on a server. Apply Mageia , Oracle , SciLinux , and SUSE cybersecurity solutions to combat significant downtime, system compromise, and data theft. Stay on top of the latest cybersecurity trends, computer security news, and general updates by registering under our open-source cybersecurity projects and applications. If you are a LinuxSecurity user , subscribe to our Linux Advisory Watch security newsletter and customize your advisories based on your distro(s). Having these updates will keep you from falling behind on security patching and other network security issues that could make your system more susceptible to attacks in the future. Also, follow @LS_Advisories on Twitter for real-time updates . Recommended Reading Looking to learn more about the benefits and drawbacks of Linux proxy servers and how to set up a Squid proxy server? Ourrecent feature article, Everything You Need to Know About Linux Proxy Servers , provides an in-depth discussion of the topic. Have additional questions regarding how to improve security posture? Drop us a note so we can help you out! . Examine pivotal Squid weaknesses and discover methods to bolster information and network protection against potential threats.. Squid Proxy, Cybersecurity Threats, System Protection, Network Security Updates. . Brittany Day
Nov 13, 2023
•
102
network securitymalwaresecurity awarenessProtecting Your Linux Systems Against Emerging Malware Threats
If you’ve been keeping up with the latest IT security news, you may have noticed the increase in the number of attacks on network security within Linux systems. Cloud Snooper, EvilGnome, HiddenWasp, QNAPCrypt, GonnaCry, FBOT, and Tycoon have become prime malware variants to be aware of when working. . Linux is considered a highly secure operating system, so these cloud security breaches may leave users concerned about the integrity of the company. In this article, LinuxSecurity.com aims to put these recent Linux attacks into perspective, provide some background on Linux malware, and shed some light on other concerns users might have. The Modern Linux Threat Landscape in a Nutshell Despite the heralded safety landscape on Linux operating systems, network security threats, including malware and viruses, have grown to be serious concerns for Linux users. Attacks in network security have targeted Linux, as threat actors hope to obtain a Return on Investment when accessing such systems. As of March 2018, 15,762 new Linux malware variants were developed , which is a notable increase from the 4,706 new variants developed by March 2017 . The evolution of malware research in recent years has offered superior visibility into exploits in cyber security that threaten Linux servers. A vulnerable server of any sort is an open door for data and credential theft, DDoS attacks, cryptocurrency mining, and web traffic redirection. Most significantly, it can be used to host malicious Command and Control (C&C) servers. Just over a year ago, bringing to conclusion a collaborative three-year effort, security researchers identified various OpenSSH backdoors, including the notorious Linux/Ebury backdoor, which could be used to compromise servers with dangerous malware. Simultaneously, ESET researchers exposed 21 Linux-based malware families , 12 of which were previously undocumented. In a sense, these findings confirmed an evolving, increasingly dangerous array of data and network security threats, putting Linuxusers and their systems at risk. A Brief History of Linux Malware The increasing prevalence of Linux malware in recent years arguably creates the illusion of a new network security threat targeting Linux systems; unfortunately, though, Linux malware has been around for quite some time. The first piece of Linux malware, dubbed Stoag, was identified in 1996. Staog was a basic virus that attempted to gain root access by attaching itself to running executables, but it did not spread very successfully and was rapidly patched. Stoag made its claim to fame as the first piece of Linux malware, but Bliss, recognized in 1997, was the first Linux malware variant to grab headlines. Similar to Stoag, Bliss was a fairly mild infection that attempted to grab permissions via compromised executables, but it could be deactivated with a simple shell switch, fortunately. Guardian Digital CEO and LinuxSecurity.com founder Dave Wreski commented on the evolution of Linux malware, “Over the years, malware targeting Linux systems has become both more sophisticated and more common; however, up until fairly recently, Linux malware was still relatively scarce and primitive compared to the variants that threatened proprietary operating systems. As of 2018, there had not yet been a single widespread Linux malware attack or virus comparable to those that frequently target Microsoft Windows - which can be attributed to a lack of root access and rapid updates to the majority of Linux vulnerabilities.” Unfortunately for Linux users, the era of complete data and network security has ended, as the Linux threat landscape has remodeled to become significantly more complex and dangerous to users. Why Is Linux Malware A Growing Concern for Administrators? Much to the dismay of Linux system administrators and users, all of 2019 and the start of 2020 were plagued with emerging malware campaigns targeting Linux servers. These attacks in network security demonstrated new and dangerous tactics for spreading, allowing such cloudsecurity breaches to remain undetected prior to compromising servers. Let’s go over the main Linux malware strains that have popularized in the past couple of years. CloudSnooper CloudSnooper uses a unique combination of sophisticated techniques to sneak into Linux and Windows servers so the malware can communicate freely with command and control servers through firewalls. CloudSnooper enables threat actors to work through servers “from the inside out” and is the first example of an attack formula that combines a bypassing technique with a multi-platform payload, targeting both Windows and Linux systems. While each individual element of CloudSnooper’s Tactics, Techniques, and Procedures (TTPs) has been observed previously, these aspects have not been utilized in combination until now. Experts in cyber security trends predict that this package of TTPs will be used as blueprints for dangerous new firewall attacks that could put data and network security in the line of fire. In sophisticated exploits in cyber security utilizing CloudSnooper, hackers pawned Amazon Web Services (AWS) servers and set up a rootkit, which enabled the cybercriminals to remotely control servers. Once they did this, the threat actors funneled sensitive data from compromised Windows and Linux machines to Command and Control (C2) servers. Security researcher Willem Mouton describes the attack: “From a technical perspective, it is a thing of beauty, as well as the fact that they made it cross-platform.” EvilGnome Discovered in July 2019, EvilGnome disguises itself as a Gnome shell extension so it can remain undetected by security software while spying on desktop users. EvilGnome is delivered via a self-extractable archive created using the make self shell script, and the infection is automated with the help of an autorun argument left in the headers of the self-executable payload. When downloaded on a Linux system, the malware is capable of stealing files, taking desktop screenshots, and capturing audio recordings fromthe user’s microphone so they can be downloaded and utilized in other modules. EvilGnome attacks have been linked to the Gamaredon Group, a Russian Advanced Persistent Threat (APT) group notorious for developing custom malware variants. Both hacker groups use the same hosting provider and engage with the same C2 domains. Nothing has been confirmed regarding the connection between the groups, but Linux malware experiences have been similar between EvilGnome and Gamaredon Group. Therefore, it is highly likely that these attacks on network security come from the same source. HiddenWasp In early 2019, security researchers discovered a new strain of Linux malware created by Chinese hackers, which could be used to remotely control infected systems. Dubbed HiddenWasp, this sophisticated malware consists of a trojan, a user-mode rootkit, and an initial deployment script. HiddenWasp is deployed as a second-stage payload and is capable of running terminal commands, interacting with the local filesystem, and more. HiddenWasp displays similarities to several other Linux malware families, including Azazel, ChinaZ, and Adore-ng, suggesting that some of its code may have been borrowed. Unlike common Linux malware, HiddenWasp is not focused on DDoS activity or crypto-mining. Instead, it is a trojan used solely for targeted remote control. QNAPCrypt This past summer, security researchers identified a rare instance of Linux ransomware targeting Network-Attached Storage (NAS) servers. The malware, which they named QNAPCrypt, is an ARM variant that encrypts all files; however, unlike standard ransomware, the ransom note is delivered solely as a text file without any message on the screen. Each victim is provided with a unique Bitcoin wallet, a tactic that helps conceal the identity of the attackers. Once a system is infected, the ransomware requests a wallet address and a public RSA key from the C2 before file encryption. Fortunately, this is a flaw in QNAPCrypt’s design that enables victims to temporarily blockthreat actors’ operations to protect further data and network security. Despite this weakness, QNAPCrypt represents the “evolution and adaptation of an attack to bypass security controls.” Unfortunately, it isn’t very common for Linux system administrators to deploy endpoint monitoring to network file servers. GonnaCry GonnaCry is an emerging Linux ransomware variant under active development in Python and C for research purposes. Lead developer Tarcisio Marinho explains the motivation behind his work: “Since the worldwide spread of the Wannacry ransomware in May 2017 affected so many countries and companies, I kept wondering: Is it really hard to mess with a company’s or a person’s life with a computer? The answer is yes, it’s possible. And ransomware is a computer virus so powerful to do so.” GonnaCry begins its work by finding the files it will encrypt. Once it has identified these, the malware starts its encryption routine and creates a desktop file that will help the decryptor access the path, key, and IV used to encrypt each file. The ransomware then frees the memory allocated by the files on the computer. GonnaCry does not rival notorious variants like WannaCry and Petya in complexity, but according to Marinho, “The basic structure is working.” FBOT FBOT is a client variant of the infamous Mirai botnet that targets Linux IoT devices. According to the “Malware Must Die!” blog, FBOT re-emerged on February 9, 2020, after a month of inactivity, offering several technical updates , including advances in its infection method and its increased propagation speed. “Malware Must Die!” reflects on the re-emergence of FBOT and the future of Linux IoT malware: “We are in an era where Linux or IoT malware is getting into better form with advantages. It is important to work together with threat intelligence and knowledge sharing to stop emerging malicious activity before it becomes a big problem for all of us later on.” Tycoon Tycoon is an emerging strain of Java-basedransomware that targets both Linux and Windows systems. This dangerous ransomware variant, which was discovered by Blackberry security researchers, uses a little-known file format, making it highly difficult to detect before it detonates its file-encrypting payload. The researchers who discovered Tycoon reported that this was the first time they had seen a ransomware module compiled into a Java image (JIMAGE) file format. JIMAGE files are rarely scanned by anti-malware engines, and malicious JIMAGE files stand a good chance of going undetected as a result. BlackBerry explains in a blog post , “Malware writers are constantly seeking new ways of flying under the radar. They are slowly moving away from conventional obfuscation and shifting towards uncommon programming languages and obscure data formats.” BlackBerry researchers say that they have recently observed roughly a dozen “highly targeted” Tycoon infections, and the attackers appear to carefully select their victims, favoring small- and medium-sized businesses in the software and education industries. However, as is often the case, the researchers suggest that the actual number of infections is likely much higher. Knowing the various network security threats taking control of Linux systems is vital in making sure you take care of your server to prevent cyber security vulnerabilities from being exploited. Tips & Tools for Defending Linux Servers Against Malware With attacks in network security targeting Linux servers becoming increasingly common and dangerous, defending against malware and other advanced Linux threats is more critical than ever in maintaining a secure Linux system. Here are some tips and tools to consider when securing your Linux system, all of which can mitigate cyber security vulnerabilities and provide more data and network security: Double-check all cloud configurations, as user misconfiguration and lack of visibility are the top causes of cloud security breaches. Ensure that remote access portals are properlysecured. Many network-level attacks are made possible because attackers find their way in through a legitimate, insecure remote access portal by impersonating a trusted source. Create a complete inventory of all devices connected to a network and update all security software used on these devices frequently. Make sure that all external-facing services are fully patched. Be aware that firewall security is not a substitute for an organization’s own cloud security measures, and security patching should be done regularly. Set special rules in your firewall to block control packets specific to Cloud Snooper. Enable multi-factor authentication on all security dashboards or control panels used internally to prevent threat actors from disabling security software in the event of an attack. Review system logs regularly. It’s rare that threat actors are able to take over servers without leaving some trace of their actions, such as log entries showing unexpected or unauthorized kernel drivers being activated. Keep in mind, however, that criminals who already have root powers can tamper with your logging configuration and the logs themselves, making it more difficult to spot malicious activity. Remember that a comprehensive, defense-in-depth approach to security is essential in protecting your system from modern, advanced exploits in cyber security. How Can I Rapidly and Accurately Identify and Eliminate Linux Malware? If malware does get downloaded on your system, being able to rapidly and accurately identify and eliminate it is critical to protecting yourself, your users, and your files. Luckily, there are various effective open-source network security toolkits that can be used to detect and remove malware on your system: Linux Malware Detect: Linux Malware Detect is a malware cloud security scanner that can be used to detect malware in shared Linux environments. It utilizes threat data from network edge intrusion detection systems to identify and extract malware that is actively beingused in attacks and generates signatures for detection. This tool also derives threat data from user submissions and community resources. The Rootkit Hunter & Check Rootkit: The Rootkit Hunter (Rkhunter) and Check Rootkit ( chkrootkit ) are tools that scan local systems, identifying any potentially malicious software, such as malware and viruses that mask their existence on a system. Volatility: Volatility is an open-source memory forensics cloud security framework for incident response and malware analysis. Lynis: Lynis is a command-line application that scans a local or remote system to help an auditor identify potential network security issues. Cuckoo Sandbox: Cuckoo Sandbox is an excellent privacy sandbox for malware analysis. This tool allows you to safely execute possible malware samples, and it provides a comprehensive report on the code executed. Kali Linux: Kali Linux is a Linux distribution used for penetration testing, ethical hacking, and digital forensics. The included security penetration and management tools can be used for network discovery and other research purposes, as well as to identify potential cybersecurity vulnerabilities. Kali Linux includes many of the other network security. Malware as a Business The malware market is rapidly expanding and evolving, forcing the security industry to keep pace. The success of this market drives rapid innovation, perpetuating growth and encouraging further malicious activity. Threat actors are cr eating and utilizing increasingly agile and sophisticated malware strains in their attacks on network security, challenging engineers to build stronger defenses against them. Traditional antivirus software is no longer effective in detecting and combating advanced, modern exploits in cyber security. Protecting against today’s sophisticated malware threats requires a comprehensive, defense-in-depth approach to digital security. According to Verizon, 92.4 percent of malware is delivered via email . Thus, an effectiveemail security strategy is imperative in preventing dangerous and costly infections. Malware is a serious network security threat to all businesses, as an infection can result in significant downtime, recovery costs, and reputation damage. Small businesses face a heightened risk because they often lack the resources and funding necessary to support a full-time IT department. Guardian Digital EnGarde Cloud Email Security provides fully managed, multi-layered email protection against malware, phishing, and other persistent email-borne network security threats. Through a transparent, collaborative, open-source approach to software development, Guardian Digital is able to access and provide resources and tools from an innovative global community in a way that no other vendor can. This approach, combined with decades of industry experience and engineering expertise, enables Guardian Digital to offer flexible enterprise-grade solutions to businesses of all sizes at competitive prices. Key benefits of EnGarde’s protection include: Advanced real-time defenses against social engineering and impersonation attacks Email encryption and sender authentication protocols detect fake “From” addresses and block them automatically Neutralizes network security threats associated with malicious attachments and links A scalable cloud-based system simplifies deployment and increases availability Tighter data and network security, adaptive implementation, and eliminated risk of vendor lock-in through the use of a community-powered open-source approach to software development Professional engineering services, as Guardian Digital expert engineers take the time to learn about each client’s key assets, operations, and specific needs Passionate, knowledgeable, around-the-clock customer support services Final Thoughts on Linux Malware Despite the growing number of data and network security threats targeting Linux systems, there is still solid evidence that Linux is secure by design. There is avibrant worldwide community that provides strong arguments and seeks to improve security posture by scrutinizing all resources introduced, allowing companies to have more transparency with their open-source code once it is accessible to all operating systems intended. Because of the workers constantly reviewing the source code in Linux kernels, cyber security vulnerabilities are identified and remedied faster than flaws that exist in the opaque source code of proprietary operating systems like Microsoft Windows. Threat actors recognize and exploit such weaknesses, directing the majority of their attacks at proprietary software, platforms, and operating systems. According to ESET security researchers, the Operation Windigo botnet, which uses Cdorked web servers to compromise Apache and more, has been detected in 26,000 infections since May 2013. The infamous ZeroAccess Windows-based botnet had infected nearly two million Windows PCs before it was taken down in December 2013. The digital threat landscape is rapidly evolving to become more advanced and dangerous. While the majority of attacks in network security still victimize proprietary operating systems, threat actors are experimenting with newer targets like Linux. Linux users should undoubtedly be aware of the growing risk that their systems face and recognize that as this new decade unfolds, prioritizing system data and network security and maintenance is more critical than ever. In many cases, malware attacks can be attributed to administration issues and cyber security vulnerabilities in individual accounts instead of to poor operations. Guardian Digital CEO Dave Wreski states, “Although it may be easy to blame the rise in Linux malware in recent years on security vulnerabilities in the operating system as a whole, this is unfair and largely untrue. The majority of malware exploits on Linux systems can be attributed to misconfigured servers.” On a broader scale, the rise of Linux malware should serve as a wake-up call for the securityindustry to allocate more resources to detect these network security threats. As Linux malware continues to become more complex, even more common malware will target Linux frequently and still fly under the radar. . Linux is considered a highly secure operating system, so these cloud security breaches may leave use. you’ve, keeping, latest, security, noticed, increase. . Brittany Day
Jun 18, 2023
•
102
security advisorysecurity updatesystem protectionRocky Linux 9 Security Advisory Updates for Enhanced Protection
Are you a Rocky Linux user looking to track the latest Rocky Linux security advisories to maintain an updated, secure system? Then we have great news for you- LinuxSecurity.com has now added Rocky Linux to its Advisories database ! . Why Is Tracking Advisories Critical for Robust Security? Security vulnerabilities are a favorite among malicious actors, as exploiting these bugs is relatively easy compared to zero-day vulnerabilities for which no patches are available. By tracking the security advisories issued by your distro, you can apply updates as soon as they become available to mitigate the risk that known vulnerabilities pose to the security of your systems. Is Rocky Linux Secure? Rocky Linux has earned the reputation of being a secure, stable distro suitable for the enterprise. The recent release of Rocky Linux 9 has introduced several notable security features: Since the cryptographic hash functions generated by SHA-1 are no longer regarded as secure, the use of SHA-1 message digests for cryptographic purposes has been discouraged. OpenSSL has significant enhancements in version 3.0.1, including support for additional protocols, formats, algorithms, and more. Other changes include a provider concept, a new versioning system, an enhanced HTTP(S) client, and more. The most significant change in OpenSSH 8.7p1 is the substitution of the SFTP protocol for the SCP/RCP protocol, which provides more predictable filename processing. Major improvements have been made to SELinux speed, memory overhead, load time, and other factors. It is safe to say thay Rocky Linux will remain secure into the future given that it heavily relies on released security package updates from RHEL. Why LinuxSecurity.com Should Be Your Go-To Resource for Tracking Advisories LinuxSecurity.com makes staying informed of the latest updates available for the open-source programs and applications you use daily simple and convenient by tracking the latest security advisories for 15 popular distrosand offering the ability to create a user profile and customize your advisories based on the distro(s) you use. We’ve recently begun tracking advisories for Oracle Linux and Rocky Linux, as these two popular distros have emerged as excellent alternatives to CentOS Linux 8, which reached end of life earlier this year and is no longer supported. By subscribing to our weekly Linux Advisory Watch Newsletter , you’ll be informed via email when your distro(s) has released an update for a vulnerable program or application highlighted in that week’s newsletter. In addition to providing a comprehensive, strategic way for admins to ensure that they receive the updates and guidance they need to keep their systems secure, LinuxSecurity.com offers extensive training and documentation to help them troubleshoot issues and expand their skill set. Be sure to check out our recent Official Guide on Rocky Linux & How To Install It to learn about the pros and cons of Rocky Linux, how it compares to CentOS, and how to install Rocky Linux. Next Steps If you haven’t registered as a LinuxSecurity user and customized your advisories, what are you waiting for? Do yourself a favor and make your life as a Linux admin easier and more secure. Join the LinuxSecurity Community Now! Connect with LinuxSecurity on social media: Twitter | Facebook | LinkedIn . Monitoring Ubuntu security updates guarantees that system patches counteract potential threats and uphold safety.. Rocky Linux Security, Security Advisories, Advisory Tracking, System Protection. . Brittany Day
Oct 03, 2022
•
102
security practiceskernel securitysystem protectionHow to Secure Your Linux System Against Kernel Threats and Attacks
The Linux kernel is the core component of the Linux operating system, maintaining complete control over everything in the system. It is the interface between applications and data processing at the hardware level, connecting the system hardware to the application software. The kernel manages input/output requests from software, memory, processes, peripherals and security, among other hefty responsibilities. Needless to say, the Linux kernel is pretty important. . However, with power comes great responsibility, and the Linux kernel is no exception to this rule. Kernel security is critical: it determines the security of the Linux operating system as a whole, as well as the security of every individual system that runs on Linux. Vulnerabilities in the kernel can have serious implications for Linux users, and it is extremely important that users stay up-to-date on news and advisories pertaining to kernel security. In this article, LinuxSecurity examines how kernel security has evolved in recent years and how to mitigate your risk as a Linux user. A Brief History of the Linux Kernel The Linux kernel was created in 1991 by Linus Torvalds for his personal computer. Torvalds had no cross-platform intentions for the kernel; however, over the past two decades the Linux kernel has expanded and evolved to support a wider array of computer architectures than any other kernel or operating system. Not long after its conception, Linux began to attract developers, contributors and users worldwide and was rapidly adopted as the kernel for many free software projects, including the GNU Operating System . Intro to Linux Kernel Security Kernel security is a hot topic in the Linux community due to the fact that a large portion of kernel bugs present potential security flaws. For instance, vulnerabilities in the Linux kernel may allow for privilege escalation or create denial-of-service attack vectors. Many of the more severe vulnerabilities discovered in the Linuxkernel result in attacks that can be carried out remotely without any actions taken by the victim. These attacks present a bigger threat than those that require hackers to have a local account. In general, Linux is an exceptionally secure operating system, which can be attributed to the principles of transparency and collaboration upon which the OS was founded. However, as with any OS, security bugs are inevitable. Thanks to a supportive, passionate and active community, a large portion of the vulnerabilities that exist in the Linux kernel are identified and fixed before they become a significant problem. Others slip through the cracks and cause more grief before they are recognized and addressed. While there have been many more security vulnerabilities that have been found and fixed in the Linux kernel than the ones listed below, some of the most notorious bugs that have been discovered and remedied over the years include: CVE-2017-18017: This critical vulnerability, which exists in the netfilter tcpmss_mangle_packet function, is extremely dangerous because of the important role that it plays in filtering network communications by defining the maximum segment size that is allowed for accepting TCP headers. Without these controls in place, users are susceptible to overflow issues and DoS attacks. The flaw impacts versions before 4.11. CVE-2016-10229: This udp.c bug, also affecting versions prior to 4.5, allows remote attackers to execute arbitrary code via UDP traffic, triggering an unsafe second checksum during the execution of a recv system call with the MSG_PEEK flag. CVE-2016-10150: This use-after-free vulnerability affecting Linux kernel versions prior to 4.8.13 allows users to cause a DoS attack. This flaw could also be exploited by hackers to gain privileges. CVE-2015-8812: This severe vulnerability impacting versions prior to 4.5, which was discovered in the drivers of the Linux kernel, enables remote attackersto execute arbitrary code or cause a DoS (use-after-free) via crafted packets. CVE-2014-2523: This serious netfilter vulnerability, which impacts versions through 3.13.6, can be attributed to the incorrect use of a DCCP header pointer. The flaw allows remote attackers to cause a DoS (system crash) or to execute arbitrary code via a DCCP packet that triggers a call to either the dccp_new, dccp_packet, or dccp_error function. Balancing the Risks of Public Bug Disclosure When a kernel vulnerability is identified, members of the Linux community collectively work to fix it. While this collaboration leads to rapid innovation and effective patches, the publication of patch proposals before their inclusion in the mainstream kernel branch does carry some degree of risk. Threat actors could potentially reverse-engineer a zero-day bug using patch proposals shared on the public mailing list. The community does have guidelines in place to mitigate this risk and keep patch proposals in the right hands until a patch is ready. A private mailing list exists for communicating with individual Linux distribution vendors, giving them time to prepare kernel patches in advance of public disclosure. However, the code for a patch eventually has to make it onto the public repositories that contain the source code for the Linux kernel. Greg Kroah-Hartman , a Fellow at the Linux Foundation responsible for the Linux kernel stable releases, explains: “There is no way to ‘hide’ our work or patches as everything we do is released publicly in our trees. So yes, if you really wanted to see what is ‘broken’ in Linux, you ‘just’ watch everything that is merged into the kernel tree as it has hundreds of fixes for problems every week.” This would be a difficult job, but by no means should be written off as impossible for a determined hacker, especially if he or she were to use ‘-next trees’, which collect likely patches for the next mainline mergewindow. Kernel Security in 2019: Current Issues and New Security Features 2019 has been an eventful year for the Linux kernel. While kernel security is never stagnant, some notorious security issues continue to plague the kernel. One example is Intel’s persistent CPU problems , which have led to Meltdown and Spectre security issues . Zombieland v2 , a security hole which allows hackers to gain read access to your data or to hang your system and can also be used against all recent Intel processors including Cascade Lake, is the latest of these problems. Greg Kroah-Hartman, the stable Linux kernel maintainer, recently commented on Intel’s notorious CPU issues, “These problems are going to be with us for a very long time, they're not going away. They're all CPU bugs, in some ways they're all the same problem, but each has to be solved in its own way. MDS, RDDL, Fallout, Zombieland : They're all variants of the same basic problem.” And securing your OS against these attacks as they appear is a tedious process which could result in a significant performance hit. For instance, disabling hyper-threading to protect systems against Zombieload attacks has been shown to decrease performance for certain workloads by 30% to 40% . In the words of a Chinese developer who recently spoke with Kroah-Hartman, “This is a sad talk.” On a brighter note, this past month Linus Torvalds finally approved a new security feature, the Linux Security Module (LSM) , nicknamed “lockdown”, to be included in version 5.4 of the kernel. The purpose of the feature is to restrict various aspects of kernel functionality, prevent modification of kernel code, and lockdown hardware that could potentially generate direct memory addressing, among other security benefits. The feature, which has been in the works since 2010, was engineered by Mathew Garrett as a way to prevent users with elevated privileges from modifying the Linux kernel code. Torvalds was initially opposed tothe idea, stating that it was “nothing more than a means of getting Linux to boot on what would be Windows-only hardware”. However, with the lockdown feature now in place, Torvalds admits that it “gets us much closer to not requiring external patches”. Another key security feature that is currently in the works is Kernel Address Space Isolation . Its implementation could potentially reduce the risk of leaking sensitive data in attacks like L1 Terminal Fault (L1TF), MDS, hyper threading and other vulnerabilities. Kernel Address Space Isolation would, however, increase the complexity of the kernel code and the impact that this would have on performance has not yet been evaluated. How to Protect Your Linux System from Kernel Vulnerabilities: Tips and Best Practices for Administrators and Users While kernel vulnerabilities are often identified and patched fairly rapidly, it is up to users to take responsibility for maintaining a secure Linux system. Some best practices for protecting your system include: Track security advisories Seek out and apply software patches as soon as they are released Update your system frequently - use automatic updates when possible - and don’t forget to reboot your system once the kernel is updated! (Note: Automatic updates are available for Linux and are often easier to set up and run than those available for Windows or MacOS users) When using a stable version, plan ahead and upgrade to the next version before official support is ended Implement proper firewall filtering policies Harden your server against SYN flood attacks Disable direct memory access (DMA) to prevent DMA attacks Create regular backups Set up system monitoring tools to avoid downtime LinuxSecurity.com is a great resource for information on how to secure and harden your Linux system against kernel vulnerabilities. LinuxSecurity also tracks security advisories for thirteenpopular Linux distributions, and has an RSS feed specifically devoted to advisories. Have additional questions about kernel security or how to secure your system that haven’t been addressed in this article? Do not hesitate to contact us . We would love to continue the discussion! . Learn the methods to harden your Linux kernel and safeguard it against significant risks and contemporary exploits.. Linux Kernel Security, Protecting Linux Systems, Kernel Vulnerabilities, Security Best Practices, Linux Security Tips. . Brittany Day
Nov 19, 2019
•
102
intrusion detectionkernel securitysystem protectionSteps to Create a Robust and Secure Linux Environment Using LIDS
LIDS (Linux Intrusion Detection System) is a Linux kernel patch to enhance the Linux kernel. In this article, we will talk about LIDS, including what it can do and how to use it to build a secure linux system.. Xie Huagang (
May 16, 2000
•
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
Discover faster search, smarter navigation, and deeper Linux security insights. Read More