Hacker News Reader

Hacker News

Comment by 0x0 | Hacker News Reader

Parent Full thread

0x0

Status in Debian: https://security-tracker.debian.org/tracker/CVE-2017-6074

View on HN

Status in Ubuntu: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2...

The below should be followed at the users own risk. Perhaps someone can confirm if the following is sane.

For Ubuntu versions:

  Ubuntu 12.04.3 LTS
  Ubuntu 14.04.5 LTS

The following should get you patched up, you will need a reboot though:

  sudo apt-get update
  sudo apt-get install linux-headers-3.13.0-110 linux-headers-3.13.0-110-generic linux-image-3.13.0-110-generic

After reboot:

  uname -a
  Linux hostname 3.13.0-110-generic #157-Ubuntu

Any Digital Ocean users may need to power down their droplet and switch the kernel to the following version:

  DigitalOcean GrubLoader v0.2 (20160714) Ubuntu

Without this the new kernel may not be used.

Digital Ocean hasn't required that you change the kernel through the UI for some time now. Are you sure that's necessary?

It's only necessary for older servers (e.g. Ubuntu 12.04 and 14.04) where people haven't done this already.

you can also use the API for this https://developers.digitalocean.com/documentation/v2/#change...

for example for precise the kernel ID is 7515 for the "DigitalOcean GrubLoader v0.2 (20160714) Ubuntu" kernel. If you do this be sure to double-check the id by listing the kernels using the API though. You can also do this with libcloud using 'ex_change_kernel' from the 'DigitalOcean_v2_NodeDriver'

RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1423071

Edit: I'm looking for something for CentOS but I can't even find a tracker where they put CVE's?

CentOS should get their stuff when RedHat is finished, as is usually the case, I think.

Yeah, just look for a kernel package the same name (including minor version numbers) as the upsteam redhat one. You can find info on Redhat Errata here[1]. CentOS looks to have some form of errata listing (possibly non-official) here[2].

You could theoretically locate teh SRPM for the kernel and build from that, but I haven't done that in years and the last I heard RedHat was going to make that harder because they weren't happy Oracle was copying their work wholesale and then selling it as a competitor, so that may be harder now?

Redhat is finished, CentOS is probably just lagging a little bit.

1: https://rhn.redhat.com/errata/

2: http://centoserrata.nagater.net/list.html

I use RHEL6 at work, so we already get errata notifications :).

Status in SLES: https://www.suse.com/security/cve/CVE-2017-6074.html

Reply on news.ycombinator.com