[Non-zealot mode on]

I don't get your statement regarding servers. If I understand correctly the vulnerability, it has to be triggered by a malicious executable, right?

I guess most servers don't (most of the time) run new software, obtained from unknown or dubious sources, right?

So, my understanding is that this vulnerability is more a threat for unmanaged desktops, typically the home PC where the admin-owner-user downloads and tests stuff from ...various places :-)

Did I miss something here?

It is a little more complicated. If you read the full article at the start of the other thread it explains the entire problem fairly well.

____

IMO the real question is not when will it be fixed (because honestly if anyone is overly concerned they should update their own kernel immediately and not wait for someone else to do it) but why was it swept under the rug for so many years. That part freaks me out a little because I honestly didn't think linux kernel developers would do such a thing... I am hoping I don't know the whole story and that there was good reason...

1 members found this post helpful.

Please help me understand what "is a little more complicated". I read the cited article (and several other describing the vulnerability in detail). I think that I understand the mechanism of the vulnerability.

What I also understand is that the vulnerability has to be triggered by a malicious executable, right?

Do you manage servers? do you assume that they already contain such a malicious executable? Or that they can load and execute one?

Sorry.. I wasn't implying you didn't read or understand the article. I should have explained that part better.

I do manage a slackware server at a college. From what I understand a person with 'user' privileges sitting at a terminal could use this exploit. I will be 100 percent honest here and say that the more I read the more complicated and unlikely it seems...

There is also talk of other devices such as android phones possibly being exploited. Like I said I am only going by what I am reading and by no means an expert. It does look like it will be a headache for a lot of people in the coming weeks/months.

I can't speak for this particular vulnerability. But, assuming someone is at a login prompt, has a target and a plan, they don't even need a login if they know what they're doing. If you're interested in a more complete understanding, this video is good.

https://youtu.be/tVG8e_Dneag

1 members found this post helpful.

This is a better video https://www.youtube.com/watch?v=kEsshExn7aE

Sigh In my opinion, anyways.

1 members found this post helpful.

No big deal I was also pissed by how media can pick up one vulnerability among many and make big dramatic statements about it.

This one has many good ingredients: a catchy name, a fun logo, Linus let it go for 11 years, your toaster can be pwned at any time now, blah blah...

From the El Reg article cited in the the other thread:
If a hacker can execute a malicious program in your home router, he is probably already root and don't need the exploit!

OTOH for Android, if the vulnerability works on it, it is a bigger deal. A rogue app, even with no or few permission, could root your phone... And not everybody did patch their Android kernel on October 21st

2 members found this post helpful.

I've found Slackware to be very timely with security updates.

3 members found this post helpful.

This poor c0w is dead with unpatching kernel with Grsec

http://www.hostmat.eu/images/88573087560098853844.png

Two stopped exploits /PoC/ .
The first using PTRACE the second /proc/self/mem :-)

1 members found this post helpful.

Among many other things, I'm running a few Wordpress installations for a few clients as well as for myself. I concur that a box running nothing is much more secure.

My $0.02... if you can't learn and do for yourself, such as build your own kernel, patch your own packages, then you have no business using any version of GNU/Linux as a user or administrator of any system or network.

So Patrick hasn't released a patch within Slackware yet Darth, you have the ability to do it yourself, as the old saying goes...

What's your point?

4 members found this post helpful.

Although I've upgraded my systems manually, I do think that a patch should be issued for this. It's just not something that you want lying around in your system. Interesting to note that grsec catches this one though.

4 members found this post helpful.

I am just an old man who likes computers and Linux. I have had no formal training and most of the time have no idea what I am doing BUT I just compiled and switched over to linux-4.4.27
Was able to compile kernels years ago but now recall nothing of that experience so had to start from scratch.
Thanks to Alien Bob for his instructions in the Slackware Book

4 members found this post helpful.

Like anything the patch will come soon enough, but for now, anyone can do this themselves. You can wait for Patrick to add the patch officially, or you can add it yourself and not have to wait. Of course common sense should tell you, you should do it yourself.

I am from a similar part of the world (if they are indeed Romanian) and I can say that we are more direct which doesn't translate well into some other cultures where you need to be a bit more "flowery". Not saying the OP wasn't being demanding, or that this attitude would be appropriate otherwise but I generally give people the benefit of the doubt when they're from a different culture, speaking in a language that isn't their native tongue.

4 members found this post helpful.