A highly dangerous privilege escalation vulnerability, which can allow an attacker to execute arbitrary code as root from any GUI application, has been patched in the Linux kernel.

The FreeBSD developers have released new updates to their operating system to close three vulnerabilities. Users with restricted privileges can reportedly exploit all three holes to elevate their privileges. One of the vulnerabilities is caused by a design flaw recently also discovered and fixed in the kernel. It allows programming flaws to cause a NULL pointer dereference.

Brad Spengler, the developer behind the Grsecurity project, has published an exploit for a vulnerability in the Tun interface in Linux kernel 2.6.30 and 2.6.18, used in Red Hat Enterprise Linux 5 (RHEL5), which can be exploited by attackers to obtain root privileges. Of particular interest is the fact that the exploit is even able to circumvent security extensions such as SELinux.

One of the benefits of moving the different graphics hardware drivers over to using kernel mode-setting, an in-kernel GPU memory manager (whether it be GEM or TTM), and other newer X innovations is the possibility of now running the X Server without root privileges.

Over the past few years more of the Linux graphics stack has moved within the Linux kernel so that there is finally a proper kernel memory management solution for the open-source graphics drivers and to also provide kernel mode-setting.

According to a number of Linux distributors, a bug in the udev service under Linux can be exploited to obtain root privileges. The kernel uses udev to dynamically create device-specific files and folders (/dev/) for input and output, so that only devices which are actually connected appear in /dev.

A flaw in the implementation of the Reliable Datagram Sockets protocol (RDS) in the Linux kernel can be exploited to gain root (also known as superuser) rights or permissions on a victim's system. Attackers can exploit the hole to get complete control remotely once they have broken into the system.

When a vulnerability researcher discloses a flaw in a widely-used operating system or application, some IT professionals question the motive. Such has been the case with a Linux Kernel flaw that was disclosed last week.

A Linux kernel bug in network socket initialization could allow an attacker to acquire root privileges to inflict damages. The security hole applies to all kernels of the 2.4 and 2.5 series and has been around possibly since 2001.