Bruce Dubbs wrote: > William Immendorf wrote: >> I've recently stumbled upon an security flaw in Linux. It affects >> Linux < 2.6.32-rc6. The problem is that when using the >> pipe_read_open(), pipe_write_open() or pipe_rdwr_open() functions >> while releasing a mutex (mutual exclusion) too early, in certain >> conditions, this causes a race condition, which allows the bad guy >> to have root access, and you know what happens next. >> >> There are two fixes: One, backport a patch that fixes this issues >> to 2.6.31.6 and 2.6.30.2 (the former is the LFS Dev version, the >> latter, the 6.5 version, and for the 6.5 version, add a errata link >> to the patch..) from here: >> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ad3960243e55320d74195fb85c975e0a8cc4466c. >> http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.31.y.git;a=commitdiff;h=c40ca2aab8a3d3ba213b7b174cb2c90bd3b51235
Look vaguely familiar? :-) See also that particular commit ID (search the page for it) in: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.6 >> Please, please, patch the kernel to fix this issue, and please stop >> LFS from being exploited. It's not. > Thanks for the heads up. I don't think this is an emergency though. > New kernels are released pretty regularly. I think that 2.6.31.7 > and/or 2.6.32.0 will be released in the next day or two. At that > point we can update -dev. No point. The fix is already in 2.6.31.6... It's not in any of the changelogs (yet) for 2.6.30.x or 2.6.29.x, but that's not entirely surprising since neither of those are maintained anymore, either. Not sure what that means for the 6.5 book. (Maybe an errata saying 2.6.31.6 and newer work, and have a fix for this bug?) It *is* in the 2.6.27.39 changelog, but that's missing a few newer features too; I don't think we can roll back that far, given udev.
signature.asc
Description: OpenPGP digital signature
-- http://linuxfromscratch.org/mailman/listinfo/lfs-dev FAQ: http://www.linuxfromscratch.org/faq/ Unsubscribe: See the above information page
