Android phones rooted by “most serious” Linux escalation bug ever

 

There’s a new method for rooting Android devices that’s believed to work reliably on every version of the mobile operating system and a wide array of hardware. Individuals can use it to bypass limitations imposed by manufacturers or carriers, but it could also be snuck into apps for malicious purposes.FURTHER READING“Most serious” Linux privilege-escalation bug ever is under active exploit (updated)The technique comes courtesy of a Linux privilege-escalation bug that, as came to light last week, attackers are actively exploiting to hack Web servers and other machines. Dirty Cow, as some people are calling the vulnerability, was introduced into the core Linux kernel in 2007. It’s extremely easy to exploit, making it one of the worst privilege-elevation flaws ever to hit the open-source OS.Independent security researcher David Manouchehri told Ars that this proof-of-concept code that exploits Dirty Cow on Android gets devices close to root. With a few additional lines, Manouchehri’s code provides persistent root access on all five of the Android devices he has tested.”It’s very easy for someone who’s somewhat familiar with the Android filesystem,” Manouchehri said of the exploit. “From what I can tell, in theory it should be able to root every device since Android 1.0. Android 1.0 started on [Linux] kernel [version] 2.6.25, and this exploit has been around since [Linux kernel version] 2.6.22.”

Källa: Android phones rooted by “most serious” Linux escalation bug ever | Ars Technica