Re: Linux kernels and security issues?

[Marcus Meissner <meissner () suse de>]

On Fri, May 22, 2009 at 12:19:53AM +0200, Hanno Böck wrote:
> Hi,
>
> As we know, the linux kernel guys have security policies one can find 
> questionable.
>
> Though, I'm asking myself how to handle that? For 2.6.29.3, I read (here) that 
> an exploit is floating around (can be found on milw0rm) - so I pretty much 
> noted that it's probably a good idea to update.

Exact URL? Do you mean http://milw0rm.com/exploits/8678?

There is a ptrace exploit and studying the changelog it was fixed
with 2.6.29.3.
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.29.y.git;a=commit;h=2c9ca2baf3f368a2b747124d39bf31b779eb7571

So yes, update.

> Now we have 2.6.29.4 and I don't know if I should update again - I have some 
> production servers where I'd like to avoid rebooting too often. The Changelog 
> of a kernel minor release usually consists of several dozent entries - with 
> lots of them I don't understand.
>
> What I'd like to have is a short list of all security relevant changes, 
> including some information giving me hints if I may be affected (i.e. affects 
> core functionality or only a driver, filesystem, protocol I may or may not 
> use). Is there some place in the net providing such information?
> If someone (ocert?) wants to do the free software world a big favor, this 
> would be really a great service.

2.6.29.4 has fixes for CIFS potential remote overflow fixes (if you mount "cifs" kernel
filesystems in potentially untrusted network), and some other local denial of service
specific fixes, in splice, page_mkwrite, KVM, some small selinux things.

Unless you are using CIFS mounts I guess you can postpone the update for a bit.

There is no good place at this time, and CVE DB search might not be a good way here :/

Ciao, Marcus