Re: fwd: [vs-plain] Kernel heap overflow in bpf leading to LPE (exploit provided)

[Greg KH <greg () kroah com>]

On Fri, Nov 23, 2018 at 06:22:09PM +0100, Yves-Alexis Perez wrote:
> Hi list,
>
> we were notified on the Linux distros list of a vulnerability in the bpf
> subsystem of the Linux kernel.
>
> I asked the reported (Wei Wu) if security@k.o had been notified, and
> this was done in the following mail, leading Eric Dumazet to suggest
> posting this on netdev.
>
> In turn, this has been done just afterwards [1] so the issue is now
> public. According to the linux-distros list policy, the original
> reporter should also have made the issue public here, but failed to do
> that.
>
> I'm posting this right now in order to raise awareness for the
> distributions already including 4.19 in a supported release.

As was discussed further on one of the threads on this topic, it looks
like this is a 4.20-rc issue only, and that 4.19 does not have this
issue.  So it might not be relevant to any distro at all, but I suggest
that people test themselves to be sure.

thanks,

greg k-h