Language Selection

English French German Italian Portuguese Spanish

Device drivers filled with flaws

Filed under

Operating system vendors and hardware makers should commit more resources toward systematically auditing Windows and Linux device-driver code for flaws, security researchers say.

While buffer overflows, a type of memory flaw that can lead to serious vulnerabilities, are quickly being eradicated in critical applications, the flaws are still easily found in device drivers, said David Maynor, a research engineer for Internet Security Systems' X-Force vulnerability analysis group.

"If you look through the device driver code, there are a lot of problems," he said in a recent interview. "The state of the code's security is not strong." During a few hours on a recent plane flight, for example, Maynor found more than a dozen glitches in several Windows XP drivers.

Windows is not the only operating system at risk. A survey of the Linux 2.6.9 kernel code performed by automated-code-checking software maker Coverity found that, while the overall quality of the code had increased significantly, more than 50 percent of flaws appeared in device drivers. Many of those flaws may not affect system security, but the ratio is generally indicative of the quality of the code, said Seth Hallem, CEO of Coverity.

"The people writing the device drivers are not generally the core programmers," he said. "It is not the operating-system implementers themselves -- the Linux programmers or Windows developers -- it is generally the vendors."

The warnings come as operating-system developers have placed security higher on their to-do lists. While the Windows and Linux operating systems have both undergone significant audits in the past several years, many device drivers -- especially those created by third-party hardware providers -- have seemingly escaped rigorous testing.

Device driver flaws can be more dangerous than other application vulnerabilities because device drivers are, in most cases, part of the kernel itself and subverting the critical software gives an attacker direct access to the kernel. Moreover, drivers that have direct memory access (DMA) -- such as USB drivers, CardBus drivers, graphics drivers and sound drivers -- could be used to overwrite system memory and exploit the system.

"Since drivers run in kernel-privilege state, if you can take them over you are in a privileged position," said Bill Weinberg, Linux evangelist for the Open Source Development Labs. "But it is not an trivial thing, you are more likely to crash the system."

"You no longer have a single computer," he said. "It is a collection of subsystems and device drivers are becoming that much more important."

Full Article.

More in Tux Machines

Red Hat News

IBM releases Power-based Linux servers with Nvidia GPUs

The Power Systems LC line was introduced by Dr Stefanie Chiras, director and business line executive of IBM scale-out Power Systems, as part of her keynote on the subject of 'waitless computing'. IBM, as a patron of the OpenPower Foundation, has been a staunch supporter of Linux and OpenStack, and this represents a logical step for the company, as it has been building its Power line following the sale of its x86 server business to Lenovo in 2014. Read more

What Are Linux Meta-packages?

I was recently in a discussion about meta-packages, and realized many users don’t know what they are or what they do. So, let’s see if we can clear-up the mystery. Meta-packages in a nutshell A ‘meta-package’ is a convenient way to bulk-install groups of applications, their libraries and documentation. Many Linux distributions use them for a variety of purposes, from seeding disk images that will go on to become new releases, to creating software “bundles” that are easy for a user to install. A meta-package rarely contains anything other than a changelog and perhaps copyright information, it contains no applications or libraries within itself. The way they work is by having a list of “dependencies” that the package manager reads. The package manager then goes to the repositories to find the dependencies and installs them. (Read the rest at Freedom Penguin)

Antenna recommendation

Astros vs Yankees Live Streaming