| |||||||||||||
distro update progressdistro update progressPosted Feb 12, 2008 18:58 UTC (Tue) by incase (subscriber, #37115)In reply to: distro update progress by Velmont Parent article: vmsplice(): the making of a local root exploit
That "fix" is even worse than the problem itself: It first tries wether the exploit works and overwrites parts of kernel memory on the way. If your machine only has few and trusted users, don't use it. If you have untrusted users (or anticipate having some remote exploit allowing the attacker to execute his code under some (non-root) account, it would be better to shut down the machine until you have an updated kernel installed. Either by patching your kernel yourself or by installing a distribution kernel with the fixes in it.
(Log in to post comments)
distro update progress Posted Feb 13, 2008 10:52 UTC (Wed) by Velmont (guest, #46433) [Link] If you use the new hotfix, it will *not* use the exploit to get root but just disable vmsplice. Morten Hustveit made the patch while waiting for a pizza delivery, and didn't look at the exploit - now the second version enables sysadmins to disable vmsplice more securely. ;-)
|
|||||||||||||