Re: [PLUG] kernel bug

[Rich Freeman via plug <plug@lists.phillylinux.org>]

On Wed, Jul 21, 2021 at 12:34 PM jeffv via plug
<plug@lists.phillylinux.org> wrote:
>
> New Linux kernel bug lets you get root on most modern distros
>
> https://www.bleepingcomputer.com/news/security/new-linux-kernel-bug-lets-you-get-root-on-most-modern-distros/
>
>
> Unprivileged attackers can gain root privileges by exploiting a local
> privilege escalation (LPE) vulnerability in default configurations of
> the Linux Kernel's filesystem layer on vulnerable devices.

Since I had to dig through half a dozen links to actually find the
relevant info, the patch needed is:
seq_file: disallow extremely large seq buffer allocations

    commit 8cae8cd89f05f6de223d63e6d15e31c8ba9cf53b upstream.

    There is no reasonable need for a buffer larger than this, and it avoids
    int overflow pitfalls.

    Fixes: 058504edd026 ("fs/seq_file: fallback to vmalloc allocation")

The kernels released yesterday are patched.  Even the CVE doesn't
mention anything about anything other than the 5.13.x branch.  The
article or the linked article make no mention of vulnerable versions
at all, other than anything after 2014 (which would include kernels
released six months from now, which obviously won't be vulnerable).
Is it THAT hard to actually indicate which versions are vulnerable?

(Not directed at anybody on the list - just frustrated with security
vulnerability news in general...)

-- 
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug