3 ms·
I urge the mods to correct the title. Maybe: Linux<4.20.10 af_alg_release use-after-free vulnerability[CVE-2019-8912]
by altmind 8y ago
I urge the mods to correct the title.
Maybe: Linux<4.20.10 af_alg_release use-after-free vulnerability[CVE-2019-8912]
- cmurf 8y agohttps://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/crypto/af_alg.c?h=v4.20.11 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux... See line 126-127 and compared to the patch at the bottom of: http://patchwork.ozlabs.org/patch/1042902/ http://patchwork.ozlabs.org/patch/1042902/ Patch is not yet merged into 5.0.0rc7 either. Whereas it is in linux-next. https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/tree/crypto/af_alg.c?h=next-20190220 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-n... Update: I expect all of the longterm kernels listed on kernel.org will get a backport.
- dang 8y agoThat's too complicated. If someone can distill this to a simple, clear, neutral title, we'll happily change it.