3 ms·
This didn't work on an Arch linux (x86) box. I think I did pacman -Syu last weekend, so it's reasonably up to date. It also doesn't work on my Slackware serve
by bediger 16y ago
This didn't work on an Arch linux (x86) box. I think I did pacman -Syu last weekend, so it's reasonably up to date.
It also doesn't work on my Slackware server, which has a pretty heavily modified 2.6.23.14 kernel.
In the context of the other comments, does this mean that a lack of a software monoculture keeps these sorts of exploits from damaging the entire population of linux machines?
- bdonlan 16y agoThe exploit is specifically designed to only work on a small subset of kernel builds, as indicated in the header: * In the interest of public safety, this exploit was specifically designed to * be limited: * * * The particular symbols I resolve are not exported on Slackware or Debian * * Red Hat does not support Econet by default * * CVE-2010-3849 and CVE-2010-3850 have both been patched by Ubuntu and * Debian * * However, the important issue, CVE-2010-4258, affects everyone, and it would * be trivial to find an unpatched DoS under KERNEL_DS and write a slightly * more sophisticated version of this that doesn't have the roadblocks I put in * to prevent abuse by script kiddies.
- jacquesm 16y agoWhat a very responsible way of releasing this. Not that it would take a competent hacker more than a few minutes to figure out how to disable the blocks but at least this rules out a chunk of the 'l33t' crowd from having their way, which just might buy someone enough time to get it patched.