Running Linux on the desktop has long been the favorite mode for many security-aware organizations like Facebook and Google. Many considered Linux a more secure environment compared to commercial operating systems, especially once it was hardened with third-party products. However, recent history shows that zero-day exploits can happen to these platforms.

Fooling Linux With Zero-Day Exploits

This week, security researcher Chris Evans demonstrated a way to fool Linux. The issue in question is not very obvious because it uses subprograms that are buried within Linux to do its dirty work. It’s also not something that would much affect Linux servers, but it would impact desktop installations.

Specifically, Evans exploited a memory-corruption vulnerability that happens within GStreamer. This is a media framework found in many mainstream Linux distributions and enabled by default. The framework allows a user to play music from the 1990’s Super Nintendo Entertainment Series (SNES) of video game consoles.

The specific problem is with the Game Music Emu simulator and libgme, the library that it uses. There isn’t much in the way of bounds checking in them, and by tricking these two programs, the exploit’s goal of activating a heap overflow bug that arises during the emulation of the console’s Sony SPC700 processor is achieved.

Two audio files are available to carry out the exploit. They are encoded in the SPC format of SNES music. The exploit will change the SPC extension of the poisoned music file to FLAC and MP3 to ensure that the victim’s Linux system will automatically open them.

The Fedora Drive-By

The FLAC file functions as a drive-by attack. Ars Technica reported that if a Fedora 25 user visits a booby-trapped webpage, just one click can cause the exploit to launch. It will appear harmless, like the desktop calculator activating.

Accessing a Linux user’s repertoire of programs can go far deeper than it may in any other operating system (OS). A Linux user may have more things available — and hence modifiable — than users of another OS. It’s also possible that this exploit might access or exfiltrate all the user’s personal data.

Not only that, but the attacker is also able to steal browser cookies and sessions for other sites the victim had visited, including Gmail, Facebook and Twitter. It’s not an inconsequential exploit by any means. Users should find a legitimate patch for the program in question or avoid using it altogether.