full-disclosure - Re: The story of the Linux kernel 3.x...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <98013.1337265170@turing-police.cc.vt.edu>
Date: Thu, 17 May 2012 10:32:50 -0400
From: valdis.kletnieks@...edu
To: Adam Zabrocki <pi3@....com.pl>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>, taviso@...xchg8b.com
Subject: Re: The story of the Linux kernel 3.x...

On Wed, 16 May 2012 23:49:40 +0200, Adam Zabrocki said:

> so the latest update has this fix but still official ISO has old kernel. Fix was applied
> in March/April. So again _sock kernels_ have/had so simple mistake ;)

You're assuming it's a *mistake* rather than something intentional.

Remember that the distro does *not* know what you run on the kernel, so they
need to build one that covers all the bases.  So they really need to make a
choice.  Which is going to result in more nasty phone calls and e-mails:
leaving COMPAT_VDSO set (which is probably the 12,934th most security crucial
security setting in a distro), or turn it off and *know* this will break
certain older binaries?

Remember that if you're a distro with a million users, even if only 0.1% of
them still have old binaries, you just borked 1,000 user's machines.  Now
compare that number to the number that will get hacked if you leave COMPAT_VDSO
on (remember that the *only* thing it stops is exploits that hard-code certain
addresses)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/