2 ms·
The example in the article was fixed by backporting a patch from 5.15 to 5.10. 5.10 was released in October 2020. 5.15 was from November 2021. They also chan
by hedora 3y ago
The example in the article was fixed by backporting a patch from 5.15 to 5.10.
5.10 was released in October 2020. 5.15 was from November 2021.
They also changed the program so they only pay out for bugs in a recent kernel.
It seems more prudent to disable io_uring only on kernels that are say, over 2 years old.
Alternatively, they could upgrade their known-insecure kernels. I doubt the io_uring patch is the only missing one that was produced in the last three years.
- 7e 3y agoThat's not my read. I read that they've found a bunch of exploits in io_uring but are only willing to talk publicly about previously disclosed ones, like the one fixed by backporting to 5.10. Just because they used that as an example doesn't mean they're refusing to backport security fixes. It just means they don't want to talk about exploits they found in newer kernels, which is understandable.