linux-kernel - Re: Backport of KPTI to 2.6.32 available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180111175514.GD15344@1wt.eu>
Date:   Thu, 11 Jan 2018 18:55:14 +0100
From:   Willy Tarreau <w@....eu>
To:     Corey Minyard <cminyard@...sta.com>
Cc:     linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: Backport of KPTI to 2.6.32 available

Hi Corey,

On Thu, Jan 11, 2018 at 11:42:38AM -0600, Corey Minyard wrote:
> I've completed a backport of KPTI from linux-stable-3.2.y to 2.6.32.71, in
> case anyone is interested and wants to avoid all the work I went through.
> It's available at:
> 
> https://github.com/MontaVista-OpenSourceTechnology/linux-nonlts-secfix.git
> linux-2.6.32-secfix

Well, good job on this, thanks for sharing! However, this is just a friendly
reminder to everyone still running 2.6.32 that during my 3.10 maintenance
period after I dropped 2.6.32, I saw a significant number of bugs affecting
older versions, 2.6.32 included. So if people are using your branch above to
pick your patches and apply them to their locally maintained kernel, that's
possibly fine. However please guys don't run just the kernel above as-is as
it's definitely missing a few hundreds of fixes (~1300 were fixed in 3.10
since 2.6.32.71 was released, some addressing local privilege escalations).

Cheers,
Willy