5 ms·

It seems [1] recent kernels are not affected by this. So if you are running older (hopefully lts kernels), you might need to verify them, otherwise you should b

by bipson 10y ago

It seems [1] recent kernels are not affected by this. So if you are running older (hopefully lts kernels), you might need to verify them, otherwise you should be fine (check back with your distro obviously). [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

merb 10y ago
which is not really cool I mean I at least need to check two kernels: - Linux git 4.4.0-72-generic #93-Ubuntu SMP Fri Mar 31 14:07:41 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (Ubuntu 16.04, but I can probably switch to HWE) - Linux censored 3.10.0-514.6.1.el7.x86_64 #1 SMP Wed Jan 18 13:06:36 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (CentOS 7.3.1611) not really cool :/ happily I have no udp traffic and the AWS/internal firewall blocks all udp traffic by default.
- lathiat 10y ago
  https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10229.html https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2... Apparently xenial 4.4 is not affected.
- deleted 10y ago
  [deleted]
user5994461 10y ago
Correction: ALL production OS and kernels are affected. "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).
- Ndymium 10y ago
  Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.
  - pmontra 10y ago
    Servers are usually on LTS versions. Ubuntu 16.04 is on 4.4 last time I checked. My Android 7.0 phone is on 3.10.84, last updated in February. Edit: Ubuntu's tracker is at https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10229.html https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...
    - jbbarth 10y ago
      Patches from upstream are regularly backported by distribution vendors, including Redhat, Debian, Ubuntu (though I don't know if Ubuntu do this themselves or base on Debian). Anyway, looking at the version number is not enough, you should refer your vendor security advisories.
- pdexter 10y ago
  Arch is on 4.10.9
  - BozeWolf 10y ago
    Yes but arch is not a serious production/server os. Although some of you may do it. Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.
    - belovedeagle 10y ago
      That just goes to show that Ubuntu and friends are not serious production OS. In what world is extended vulnerability to months-old bugs a legitimate prerequisite for production viability?
- vbernat 10y ago
  This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.
  - trebla 10y ago
    Is it confirmed that kernels before 3.19 are safe?
  - mhei 10y ago
    The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare: http://lxr.free-electrons.com/source/net/core/datagram.c?v=3.19#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=3... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.1#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.2#L682 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that? EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.
    - vbernat 10y ago
      Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513d2e31894a135104b90e90 https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.
- kasabali 10y ago
  > Correction: ALL production OS and kernels are affected. No, ALL production OS backport security patches to their kernels. This bug was fixed in Debian 15 months ago and Debian stable kernel is way older than 4.5. > "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" > There is barely any OS that are >= 4.5 (only CoreOS on the top of my head). Kernel version is meaningless, see above.

by bipson 10y ago

merb 10y ago

which is not really cool I mean I at least need to check two kernels: - Linux git 4.4.0-72-generic #93-Ubuntu SMP Fri Mar 31 14:07:41 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (Ubuntu 16.04, but I can probably switch to HWE) - Linux censored 3.10.0-514.6.1.el7.x86_64 #1 SMP Wed Jan 18 13:06:36 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (CentOS 7.3.1611) not really cool :/ happily I have no udp traffic and the AWS/internal firewall blocks all udp traffic by default.

lathiat 10y ago
https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10229.html https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2... Apparently xenial 4.4 is not affected.
deleted 10y ago
[deleted]

user5994461 10y ago

Correction: ALL production OS and kernels are affected. "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

Ndymium 10y ago
Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.
- pmontra 10y ago
  Servers are usually on LTS versions. Ubuntu 16.04 is on 4.4 last time I checked. My Android 7.0 phone is on 3.10.84, last updated in February. Edit: Ubuntu's tracker is at https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10229.html https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...
  - jbbarth 10y ago
    Patches from upstream are regularly backported by distribution vendors, including Redhat, Debian, Ubuntu (though I don't know if Ubuntu do this themselves or base on Debian). Anyway, looking at the version number is not enough, you should refer your vendor security advisories.
pdexter 10y ago
Arch is on 4.10.9
- BozeWolf 10y ago
  Yes but arch is not a serious production/server os. Although some of you may do it. Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.
  - belovedeagle 10y ago
    That just goes to show that Ubuntu and friends are not serious production OS. In what world is extended vulnerability to months-old bugs a legitimate prerequisite for production viability?
vbernat 10y ago
This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.
- trebla 10y ago
  Is it confirmed that kernels before 3.19 are safe?
- mhei 10y ago
  The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare: http://lxr.free-electrons.com/source/net/core/datagram.c?v=3.19#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=3... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.1#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.2#L682 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that? EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.
  - vbernat 10y ago
    Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513d2e31894a135104b90e90 https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.
kasabali 10y ago
> Correction: ALL production OS and kernels are affected. No, ALL production OS backport security patches to their kernels. This bug was fixed in Debian 15 months ago and Debian stable kernel is way older than 4.5. > "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" > There is barely any OS that are >= 4.5 (only CoreOS on the top of my head). Kernel version is meaningless, see above.