6 ms·

Correction: ALL production OS and kernels are affected. "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic

Correction: ALL production OS and kernels are affected. "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

Ndymium 10y ago
Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.
- pmontra 10y ago
  Servers are usually on LTS versions. Ubuntu 16.04 is on 4.4 last time I checked. My Android 7.0 phone is on 3.10.84, last updated in February. Edit: Ubuntu's tracker is at https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10229.html https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...
  - jbbarth 10y ago
    Patches from upstream are regularly backported by distribution vendors, including Redhat, Debian, Ubuntu (though I don't know if Ubuntu do this themselves or base on Debian). Anyway, looking at the version number is not enough, you should refer your vendor security advisories.
pdexter 10y ago
Arch is on 4.10.9
- BozeWolf 10y ago
  Yes but arch is not a serious production/server os. Although some of you may do it. Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.
  - belovedeagle 10y ago
    That just goes to show that Ubuntu and friends are not serious production OS. In what world is extended vulnerability to months-old bugs a legitimate prerequisite for production viability?
vbernat 10y ago
This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.
- trebla 10y ago
  Is it confirmed that kernels before 3.19 are safe?
- mhei 10y ago
  The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare: http://lxr.free-electrons.com/source/net/core/datagram.c?v=3.19#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=3... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.1#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.2#L682 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that? EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.
  - vbernat 10y ago
    Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513d2e31894a135104b90e90 https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.
kasabali 10y ago
> Correction: ALL production OS and kernels are affected. No, ALL production OS backport security patches to their kernels. This bug was fixed in Debian 15 months ago and Debian stable kernel is way older than 4.5. > "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" > There is barely any OS that are >= 4.5 (only CoreOS on the top of my head). Kernel version is meaningless, see above.

Ndymium 10y ago

Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.

pmontra 10y ago
Servers are usually on LTS versions. Ubuntu 16.04 is on 4.4 last time I checked. My Android 7.0 phone is on 3.10.84, last updated in February. Edit: Ubuntu's tracker is at https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10229.html https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...
- jbbarth 10y ago
  Patches from upstream are regularly backported by distribution vendors, including Redhat, Debian, Ubuntu (though I don't know if Ubuntu do this themselves or base on Debian). Anyway, looking at the version number is not enough, you should refer your vendor security advisories.

pdexter 10y ago

Arch is on 4.10.9

BozeWolf 10y ago
Yes but arch is not a serious production/server os. Although some of you may do it. Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.
- belovedeagle 10y ago
  That just goes to show that Ubuntu and friends are not serious production OS. In what world is extended vulnerability to months-old bugs a legitimate prerequisite for production viability?

vbernat 10y ago

This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=197c949e7798fbf28cfadc69d9ca0c2abbf93191 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.

trebla 10y ago
Is it confirmed that kernels before 3.19 are safe?
mhei 10y ago
The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare: http://lxr.free-electrons.com/source/net/core/datagram.c?v=3.19#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=3... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.1#L645 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... http://lxr.free-electrons.com/source/net/core/datagram.c?v=4.2#L682 http://lxr.free-electrons.com/source/net/core/datagram.c?v=4... I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that? EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.
- vbernat 10y ago
  Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513d2e31894a135104b90e90 https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.

kasabali 10y ago

> Correction: ALL production OS and kernels are affected. No, ALL production OS backport security patches to their kernels. This bug was fixed in Debian 15 months ago and Debian stable kernel is way older than 4.5. > "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" > There is barely any OS that are >= 4.5 (only CoreOS on the top of my head). Kernel version is meaningless, see above.