8-year-old kernel security hole found

[Bachstelze]

There's already a thread on this topic, and besides, this is a support forum.

Threads merged.

[Uluru]

So what's being done about this, I dont mean to be arrogant at all, but I read about the Exploit @ the groovy "MVP hangout", calendar of Updateshttp://www.calendarofupdates.com/upd...howtopic=22012
Obviously the point must be made that this vulnerability has existed for eight years and has only just been let out of the bag.
Most importantly I can't fix this, anyone working on it

[Bachstelze]

So what's being done about this, I dont mean to be arrogant at all, but I read about the Exploit @ the groovy "MVP hangout", calendar of Updateshttp://www.calendarofupdates.com/upd...howtopic=22012
Obviously the point must be made that this vulnerability has existed for eight years and has only just been let out of the bag.
Most importantly I can't fix this, anyone working on it

You can expect a fix to appear in the Ubuntu repos in the coming hours. Unlike other distros, Ubuntu has alway been quick to fix that sort of thigs, you gotta at least admit that.

[Arup]

You can expect a fix to appear in the Ubuntu repos in the coming hours. Unlike other distros, Ubuntu has alway been quick to fix that sort of thigs, you gotta at least admit that.

One of the most important aspects that makes me stick to Ubuntu for good.

[Uluru]

You can expect a fix to appear in the Ubuntu repos in the coming hours. Unlike other distros, Ubuntu has alway been quick to fix that sort of thigs, you gotta at least admit that.

Now everyone knows about this I'm sure it'll be patched very quickly, and as you say available in the Repos. I just hate to see the hopelessly incompetent MS MVP's giggling at a Linux exploit
Surprised they have time to pull themselves away from their Malware cleaning to even notice what's going on in the "Real World".
No offence intended, even if it has to be implied

[Bad Penguin]

Anyone have any idea when an updated kernel might become available? I have searched far and wide and cannot even find a bug report on it, searching for CVE-2009-2692.

And FYI, the bug is not because some developer's bad coding. From my limited understanding of the kernel coding voodoo, the null pointers were accounted for. It is gcc compiler optimization that removed the checks after compiling the kernel. Source code looked fine, the bug only shows up in the finished product. The kernel code monkies are damn good, but I don't think they have jedi abilities like diff'ing source and binary code

[Steve H]

Well, at least it looks good if Ubuntu get it patched nice and quickly!!

[Bad Penguin]

Well, at least it looks good if Ubuntu get it patched nice and quickly!!

It is not patched, at least in dapper server LTS. I just confirmed by running the exploit posted here:

http://seclists.org/fulldisclosure/2009/Aug/0180.html

[Steve H]

It is not patched, at least in dapper server LTS. I just confirmed by running the exploit posted here:

http://seclists.org/fulldisclosure/2009/Aug/0180.html

I did say "IF" !!

[days_of_ruin]

Good thing they've found the error. Bad thing is this will give Linux's opponents ammunition about how using amateurs programmers and volunteers result in poor security, and how FOSS's community development model is not secure.

Yes because getting commit access to the linux kernel source code is only slightly harder than editing wikipedia.