14 DAY TRIAL // A new zero-day Linux kernel vulnerability has been identified (CVE-2016-0728) by a group named Perception Point, and a patch should already be in preparation for Linux distributions.
Linux kernel vulnerabilities are not all that uncommon, and they are found and patched all the time. This is why the Linux-based operating systems are usually more secure than proprietary ones. Everything gets fixed as soon as it’s found, and not a minute later. On the other hand, zero-day vulnerabilities are not all that frequent, especially for the Linux kernel.
One of the things that Linus Torvalds has always insisted on is that security is not all that important for the Linux kernel, mostly because of its size. The fact that a zero-day kernel vulnerability has been found only means that there are probably others that have yet to be discovered.
In fact, the one from today, CVE-2016-0728, has been around since 2012, which only goes to show that Linus is probably right. "The people who care most about this stuff are completely crazy. They are very black and white. Security in itself is useless. The upside is always somewhere else. The security is never the thing that you really care about," Linus explained in an older interview.
Linux kernel 3.8 and higher are affected
The Perception Point Research team found the problem and reported it back to the Kernel security team, who are already working on a patch. The problem affects any operating system with Linux kernel newer than 3.8, so there are probably tens of millions of PCs exposed. The cherry on top is that about 66% of Android devices are also exposed.
CVE-2016-0728 is described as a local privilege escalation vulnerability, which means that, if the exploit is successful, the attacker can get root access to the OS. This is bad. The good news is that it looks like Perception Point Research is the first one that identified the issue, so it hasn’t been exploited until now.
Linux operating systems will soon get patched, but they have the same problem as all the other systems that are too popular for their own good. There’ll always be some that won’t get patched, and we all know that developers work forever on Android patches.
You can find more details about this new vulnerability on Perception Point Research website, and you can expect to see a patch for your distro really soon.