4 ms·

This affects kernels from 5.8 and was fixed in 5.16.11, 5.15.25 and 5.10.102. Exploit code is public and available on the linked page.

raesene9 5y ago
< 5.8 not being affected is probably a saving grace for quite a few enterprises as I'd expect that LTS distributions may not have got that version included as yet.
- gchamonlive 5y ago
  CentOS 7 is already at 5.10 so it should affect lots of production systems
  - emrvb 5y ago
    *blinks* *stares at kernel-3.10.0-1160.59.1.el7*
    - samus 5y ago
      Is this a smartphone? I'm on 3.18!
  - LinuxBender 5y ago
    Are you by chance using a 3rd party kernel repo such as ElRepo to work around a limitation? Or could someone at your org be compiling a custom kernel?
greyface- 5y ago
Debian stable (bullseye) is still vulnerable: https://security-tracker.debian.org/tracker/CVE-2022-0847 https://security-tracker.debian.org/tracker/CVE-2022-0847
- deng 5y ago
  That page is not up-to-date, fix was released today: https://lists.debian.org/debian-security-announce/2022/msg00059.html https://lists.debian.org/debian-security-announce/2022/msg00...
  - greyface- 5y ago
    It wasn't available via `apt-get update && apt-get dist-upgrade` as of when I drafted that comment, but I confirm that 5.10.92-2 seems to be released now.
    - deng 5y ago
      Well the fix was released ~30 minutes ago, so that checks out. ;-) The security-tracker site is now updated as well.
    - bill_mcgonigle 5y ago
      Others, note that the new archive name is 'stable-security'. You might need to update your pins if you upgraded from Buster and you're not seeing the update now. I put in a pull request to add it to the release notes.
baggy_trough 5y ago
How about Ubuntu?
- zenexer 5y ago
  The relevant CVE page returns a 500 error: https://github.com/canonical-web-and-design/ubuntu.com/issues/11324 https://github.com/canonical-web-and-design/ubuntu.com/issue... 21.10 appears to be lacking the patch.
  - baggy_trough 5y ago
    The CVE page returns now, with a whole bunch of "needs triage". https://ubuntu.com/security/CVE-2022-0847 https://ubuntu.com/security/CVE-2022-0847
baggy_trough 5y ago
It's disturbing that despite prior disclosure on distro lists, Ubuntu doesn't have an update available, with public exploits circulating now.
- deleted 5y ago
  [deleted]

raesene9 5y ago

< 5.8 not being affected is probably a saving grace for quite a few enterprises as I'd expect that LTS distributions may not have got that version included as yet.

gchamonlive 5y ago
CentOS 7 is already at 5.10 so it should affect lots of production systems
- emrvb 5y ago
  *blinks* *stares at kernel-3.10.0-1160.59.1.el7*
  - samus 5y ago
    Is this a smartphone? I'm on 3.18!
- LinuxBender 5y ago
  Are you by chance using a 3rd party kernel repo such as ElRepo to work around a limitation? Or could someone at your org be compiling a custom kernel?

greyface- 5y ago

Debian stable (bullseye) is still vulnerable: https://security-tracker.debian.org/tracker/CVE-2022-0847 https://security-tracker.debian.org/tracker/CVE-2022-0847

deng 5y ago
That page is not up-to-date, fix was released today: https://lists.debian.org/debian-security-announce/2022/msg00059.html https://lists.debian.org/debian-security-announce/2022/msg00...
- greyface- 5y ago
  It wasn't available via `apt-get update && apt-get dist-upgrade` as of when I drafted that comment, but I confirm that 5.10.92-2 seems to be released now.
  - deng 5y ago
    Well the fix was released ~30 minutes ago, so that checks out. ;-) The security-tracker site is now updated as well.
  - bill_mcgonigle 5y ago
    Others, note that the new archive name is 'stable-security'. You might need to update your pins if you upgraded from Buster and you're not seeing the update now. I put in a pull request to add it to the release notes.

baggy_trough 5y ago

How about Ubuntu?

zenexer 5y ago
The relevant CVE page returns a 500 error: https://github.com/canonical-web-and-design/ubuntu.com/issues/11324 https://github.com/canonical-web-and-design/ubuntu.com/issue... 21.10 appears to be lacking the patch.
- baggy_trough 5y ago
  The CVE page returns now, with a whole bunch of "needs triage". https://ubuntu.com/security/CVE-2022-0847 https://ubuntu.com/security/CVE-2022-0847

baggy_trough 5y ago

It's disturbing that despite prior disclosure on distro lists, Ubuntu doesn't have an update available, with public exploits circulating now.

deleted 5y ago
[deleted]