linux kernels-2.6 local root vulnerability

dolphin77 · 08-19-2010, 01:14 AM

http://theinvisiblethings.blogspot.c...ux-closet.html
http://www.invisiblethingslab.com/re...ry-attacks.pdf

will this affect slackware-13.1?

Maybe new kernel has to be released in /patches ?

astrogeek · 08-19-2010, 02:47 AM

Quote:

Originally Posted by dolphin77

http://theinvisiblethings.blogspot.c...ux-closet.html
http://www.invisiblethingslab.com/re...ry-attacks.pdf

will this affect slackware-13.1?

Maybe new kernel has to be released in /patches ?

From the PDF in your second link:

Quote:

The Linux kernel versions that include the commit
320b2b8de12698082609ebbc1a17165727f4c893 from Linus tree
are fixed. Particularly, 2.6.35.2 and 2.6.34.4 are fixed.

That does not seem to include the 2.6.33.4 of SW 13.1.

ponce · 08-19-2010, 03:12 AM

I think we have to wait for the right patches

http://security-tracker.debian.org/t.../CVE-2010-2240

but it should be backportable (who knows which is the older kernel it's able to run on)

https://bugzilla.redhat.com/show_bug.cgi?id=606611

astrogeek · 08-19-2010, 03:15 AM

Quote:

Originally Posted by ponce

I think we have to wait for the right patches

HA! I built a 2.6.35.2 for one of my SW 13.1 boxes just yesterday... I think I'll do that for all of them now!

ponce · 08-19-2010, 04:34 AM

a friend, kernelOfTruth (

), pointed me to these (bug introduced by that linus' commit):

https://bugzilla.kernel.org/show_bug.cgi?id=16588

linus committed a potential fix (probably will be included in 2.6.35.3)

http://www.kernel.org/pub/linux/kern...stable-review/