Full Disclosure mailing list archives
Re: The story of the Linux kernel 3.x...
From: valdis.kletnieks () vt edu
Date: Thu, 17 May 2012 10:32:50 -0400
On Wed, 16 May 2012 23:49:40 +0200, Adam Zabrocki said:
so the latest update has this fix but still official ISO has old kernel. Fix was applied in March/April. So again _sock kernels_ have/had so simple mistake ;)
You're assuming it's a *mistake* rather than something intentional. Remember that the distro does *not* know what you run on the kernel, so they need to build one that covers all the bases. So they really need to make a choice. Which is going to result in more nasty phone calls and e-mails: leaving COMPAT_VDSO set (which is probably the 12,934th most security crucial security setting in a distro), or turn it off and *know* this will break certain older binaries? Remember that if you're a distro with a million users, even if only 0.1% of them still have old binaries, you just borked 1,000 user's machines. Now compare that number to the number that will get hacked if you leave COMPAT_VDSO on (remember that the *only* thing it stops is exploits that hard-code certain addresses)
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: The story of the Linux kernel 3.x..., (continued)
- Re: The story of the Linux kernel 3.x... Tavis Ormandy (May 16)
- Re: The story of the Linux kernel 3.x... Marcus Meissner (May 16)
- Re: The story of the Linux kernel 3.x... Adam Zabrocki (May 17)
- Re: The story of the Linux kernel 3.x... Tavis Ormandy (May 16)
- Re: The story of the Linux kernel 3.x... Dan Kaminsky (May 16)
- Re: The story of the Linux kernel 3.x... Tavis Ormandy (May 16)
- Re: The story of the Linux kernel 3.x... Adam Zabrocki (May 17)
- Re: The story of the Linux kernel 3.x... Paul Heinlein (May 16)
- Re: The story of the Linux kernel 3.x... charlie (May 17)
- Re: The story of the Linux kernel 3.x... Adam Zabrocki (May 17)
- Re: The story of the Linux kernel 3.x... Tavis Ormandy (May 16)
- Re: The story of the Linux kernel 3.x... valdis . kletnieks (May 17)
- Re: The story of the Linux kernel 3.x... Adam Zabrocki (May 18)
- Re: The story of the Linux kernel 3.x... valdis . kletnieks (May 17)