Zero-day Linux kernel security flaw leaves millions of Android users vulnerable

A new zero-day vulnerability was found inside the Linux kernel, making numerous distributions, including Android, vulnerable to attack.

A cyber security startup called Perception Point, detailed late last week a big problem that it had found inside the Linux kernel. The flaw allows an attacker to gain root level privileges by running a piece of malware on an affected device. With that elevation of privileges the attacker could then take complete control of a device and its data. Ironically, the flaw itself was found to be part of one of Linux’s security features and it relates to the way processes store secure information in keyrings.

The real problem is that this flaw affects potentially hundreds of millions of users, given that many distributions and implementations of Linux are vulnerable. The worst is probably Android itself, where 66% of users are now using operating systems vulnerable to this exploit and older than two years, with little chance of receiving much-needed security patches.

There’s less to worry about on the PC side of things, where Red Hat, SUSE, and the Linux security teams are already in the middle of deploying patches to fix this vulnerability. There’s also some good news in that there’s no evidence of this exploit being used in the wild just yet, but seeing how so many devices could be affected it’s another good reminder of why you should keep your software up to date.

Source: Perception Point via Data Breach