| |||||||||||||
Kernel.org's road to recoveryKernel.org's road to recoveryPosted Oct 10, 2011 0:39 UTC (Mon) by vonbrand (subscriber, #4458)In reply to: Kernel.org's road to recovery by malor Parent article: Kernel.org's road to recovery
Any examples handy? They would make a great point... and they must be aplenty, if we are to believe your allegations.
(Log in to post comments)
Kernel.org's road to recovery Posted Oct 10, 2011 1:19 UTC (Mon) by malor (subscriber, #2973) [Link]
Kernel.org's road to recovery Posted Oct 10, 2011 2:28 UTC (Mon) by vonbrand (subscriber, #4458) [Link] Sorry I wasn't clear. You claimed currently having shell access is equivalent to root. That I'd like to see the boatload of handy examples you've got to back this up. They would make a great point for your assertion that Linux' development is broken, and give hackers a great incentive to fix vulnerabilities and thighten up their coding.
Kernel.org's road to recovery Posted Oct 10, 2011 22:41 UTC (Mon) by malor (subscriber, #2973) [Link] Try the security alert from five days ago:From RedHat errata:
* Flaws in the AGPGART driver implementation when handling certain IOCTL commands could allow a local user to cause a denial of service or escalate their privileges. (CVE-2011-1745, CVE-2011-2022, Important) Bunch of other stuff too, but there's two likely local root exploits from October 5. Took me about ten minutes to spot, and that's only because I had to look through some lesser CVEs LWN posted about twenty minutes ago. It would have proved the point even more thoroughly to have gotten a local root exploit today, but five days ago, I think, is adequate.
Kernel.org's road to recovery Posted Oct 11, 2011 0:09 UTC (Tue) by vonbrand (subscriber, #4458) [Link] And? How do you know whoever patched the bug knew the CVEs beforehand? This is a RHEL kernel, i.e., a stable kernel (+ patches), so this came probably via the stable patch stream.
Kernel.org's road to recovery Posted Oct 11, 2011 0:24 UTC (Tue) by malor (subscriber, #2973) [Link]
Ok, I'm done talking to you. You just keep moving the goalposts around, anything to not be wrong.
Kernel.org's road to recovery Posted Oct 10, 2011 22:47 UTC (Mon) by malor (subscriber, #2973) [Link] Oh, and I didn't mention the remote root exploit from today's post, because that looks hard to exploit, involving an attempt to mount a CIFS share from a hostile server. But it is remote root, and using CIFS to share files across security boundaries is hardly unheard of.
|
|||||||||||||