LWN: Comments on "Responding to the kernel ELF vulnerability"

Responding to the kernel ELF vulnerability

gswoods — 2005-05-23T20:30:45+00:00

Today the Fedora project released a kernel update that claims to fix CAN-2005-1263, the ELF vulnerability.

Responding to the kernel ELF vulnerability

giraffedata — 2005-05-20T22:58:54+00:00

That will cause the strnlen_user() function to page fault at the first attempt to count argument lengths.

So? How does that get you to

could allow a local user to use a manipulated binary to gain elevated privileges.

Responding to the kernel ELF vulnerability

NightMonkey — 2005-05-19T10:29:04+00:00

And for Gentoo's 2.6 series: http://dev.gentoo.org/~dsd/gentoo-dev-sources/releases.htm
(See 2.6.11 patchset, release 12)

Of course, 2.6 isn't vulnerable, as seen from gregkh's comment... ;)

Can't seem to find a GLSA to go with this release, but perhaps I need to look harder?

2.6 isn't vulnerable

jhs — 2005-05-19T07:22:20+00:00

I actually specifically clicked on the comments just to post a similar message about the LWN content. So I guess I will put it here. The LWN kernel section is excellent.

2.6 isn't vulnerable

komarek — 2005-05-19T06:59:47+00:00

Comments and content like this from gregkh, are why I pay for and read LWN. How many slashdot posts would I have to read to get the same information, with the same confidence? Thanks corbet and gregkh for keep us all in-the-know.

test kernel for RHEL 4, too

barryn — 2005-05-19T06:41:47+00:00

2.6.9-10, available at:
http://people.redhat.com/davej/kernels/RHEL4/

2.6 isn't vulnerable

gregkh — 2005-05-19T06:13:58+00:00

The main reason there have not been any updates, is that there really isn't
a problem for the 2.6 kernel. The original author has admited this finally,
no one was ever able to reproduce it on a 2.6 kernel. The only reason I
released a kernel update, was at the time, we thought there was an
off-chance that there was a problem. However in further testing, it has not
been the case.

But the patch was a good one to have, to prevent any other types of this
kind of error in that same area, if some other attack vector like the
reported one were developed.

Responding to the kernel ELF vulnerability

gte223j — 2005-05-19T04:18:08+00:00

You could always mount /home as noexec and the same goes for /tmp ....... system binaries only:-0

Responding to the kernel ELF vulnerability

mattdm — 2005-05-19T02:35:41+00:00

There is an update for FC3 in the "testing" area which covers this.