Linux Kernel Security is Lacking
During the disclosure of some recent vulnerabilities in the Linux kernel, I learned some things about Linux kernel security that was truly shocking. The way security in the Linux kernel is handled is broken, and it needs to be fixed right now.
I'm a big proponent of open source software. Although personally I'm a huge follower of BSD-based operating systems, I keep an open and analytical mind when looking at any OS. Unfortunately, I was totally blown away with some of the things that I learned about Linux kernel security during the release of some recent vulnerabilities in the kernel code.
On Friday January 7, 2004, Brad Spengler posted a message to the SecurityFocus Bugtraq mailing list, which detailed several vulnerabilities in both the 2.4 and 2.6 branches of the Linux kernel. Now, first thing's first. I've said it before, but I'll say it again: vulnerabilities happen. I'm not here to berate the quality of the code in question -- that is another discussion entirely that I'll leave for a future article. Instead, I'd like to point out what I consider to be some very concerning issues with the current state of security in the Linux kernel.
