Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption in Security http://www.dslreports.com/forum/r20432885 en Fri, 09 Jan 2009 02:50:53 EDT Fri, 09 Jan 2009 02:50:53 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20435649 jdong :
said by oshooda See Profile :

Thanks for checking into that, and for the additional information.

I was pretty sure that this wasn't that much of an issue to begin with, but was a bit curious about why that kernel would still be in use if it were really as out of date as the first few posts might make it seem.
Well it always does take time for fixes to trickle down the stream so to speak. Distributions, vendors , and local administrators all tend to make decisions on whether or not to include certain patches, and whether to do so *NOW* or group a bunch together every month instead of spamming the user every other day.

From an upstream perspective this bug is an old news but certainly there might be downstream distributions that still employ a vulnerable kernel.
--
Ubuntu MOTU Developer and Forums Council]]> http://www.dslreports.com/forum/remark,20435649 Mon, 05 May 2008 16:58:39 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20435618 oshooda : Thanks for checking into that, and for the additional information.

I was pretty sure that this wasn't that much of an issue to begin with, but was a bit curious about why that kernel would still be in use if it were really as out of date as the first few posts might make it seem.]]> http://www.dslreports.com/forum/remark,20435618 Mon, 05 May 2008 16:51:24 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20433783 EGeezer : Interesting, I'm glad others provided more complete and accurate information and pointed out that the vulnerability applies to a down level mod, and current versions are not vulnerable.

I also heard there are several vulnerabilities in downlevel Windows XP ;)

All the more reason to stay as current as possible (allowing for testing of patches) regardless of platform.
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre (apparently, so do governors... )]]> http://www.dslreports.com/forum/remark,20433783 Mon, 05 May 2008 10:55:59 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20433372 SUMware : FWIW: openSUSE patch was built on 10 Feb. Thanks matunga.]]> http://www.dslreports.com/forum/remark,20433372 Mon, 05 May 2008 08:55:57 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20433362 jdong :
said by sivran See Profile :

But, it appears to be a local 'sploit. Meaning, as long as only I have physical access to it, I'm not worried. Or did I miss something?

And my 2.4 deb box can continue chugging along, doing its duty quite efficiently. :)
Your Deb box actually had a DSA released to patch that up :)

And it's not even much of a root 'sploit locally -- it can only be triggered at all with certain modules actively loaded (the deprecated VIA southbridge OSS sound driver, some USB dongle gadget, one DRI module)
--
Ubuntu MOTU Developer and Forums Council]]> http://www.dslreports.com/forum/remark,20433362 Mon, 05 May 2008 08:52:58 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20433068 antdude :
said by Trel See Profile :

Thanks for the FUD info matunga.

According to: »kernel.org/ The latest kernel is 2.6.55.1
2.6.55??!? :D]]> http://www.dslreports.com/forum/remark,20433068 Mon, 05 May 2008 06:01:42 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20432885 sivran : But, it appears to be a local 'sploit. Meaning, as long as only I have physical access to it, I'm not worried. Or did I miss something?

And my 2.4 deb box can continue chugging along, doing its duty quite efficiently. :)
--
Think outside the fox...Seamonkey]]> http://www.dslreports.com/forum/remark,20432885 Mon, 05 May 2008 02:51:43 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20432619 jdong :
said by oshooda See Profile :

Hmmm... I couldn't help but wonder when Ubuntu Gutsy will catch up.

me@cruncher:~$ uname -a
Linux cruncher 2.6.22-14-generic #1 SMP Tue Feb 12 07:42:25 UTC 2008 i686 GNU/Linux

I talked to one of our Security Team folks about this bug, and he says that he's aware of this and it's been scheduled for this week's security update to the kernel. They needed more time to test the fix for regressions than the other CVE's the last security release cycle.

(He also felt that the impact of this vulnerability is not particularly earth-shattering, as contrasted to, say, the vmsplice one)
--
Ubuntu MOTU Developer and Forums Council]]> http://www.dslreports.com/forum/remark,20432619 Mon, 05 May 2008 00:41:47 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20432435 oshooda : Hmmm... I couldn't help but wonder when Ubuntu Gutsy will catch up.

me@cruncher:~$ uname -a
Linux cruncher 2.6.22-14-generic #1 SMP Tue Feb 12 07:42:25 UTC 2008 i686 GNU/Linux
]]> http://www.dslreports.com/forum/remark,20432435 Sun, 04 May 2008 23:44:50 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20430310 Cabal : My first thought was someone had resurrected a 3 month old thread, but I guess not. :D :uhh:]]> http://www.dslreports.com/forum/remark,20430310 Sun, 04 May 2008 14:36:08 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20430205 jdong : Most vendors have already fixed this vulnerability too; it was a pretty elusive one. And the scope of seriousness is not well represented here... it's extremely difficult to trigger these corruptions unless one had elevated access to begin with.
--
Ubuntu MOTU Developer and Forums Council]]> http://www.dslreports.com/forum/remark,20430205 Sun, 04 May 2008 13:59:50 EDT Re: Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20429992 Trel : Thanks for the FUD info matunga.

According to: »kernel.org/ The latest kernel is 2.6.55.1

Also, since you seem to like security focus, here's a nice link to their solution tab: »www.securityfocus.com/bid/27686/solution

Since you like quotes, here's one
quote:
The vendor released Linux kernel 2.6.22.17 to address these issues.


--
/chown -R us:us /yourbase]]> http://www.dslreports.com/forum/remark,20429992 Sun, 04 May 2008 12:54:00 EDT Linux Kernel 2.6.22.16 and Prior Multiple Memory Corruption http://www.dslreports.com/forum/remark,20429718 anon : The Linux kernel is prone to multiple memory-corruption vulnerabilities due to insufficient range checking in certain fault handlers.

Local attackers could exploit these issues to cause denial-of-service conditions, bypass certain security restrictions, and potentially access sensitive information or gain elevated privileges.

These issues affect versions prior to 2.6.22.17.

»www.securityfocus.com/bid/27686/discuss]]> http://www.dslreports.com/forum/remark,20429718 Sun, 04 May 2008 11:28:31 EDT