Hacker News Reader

Comment by bipson | Hacker News Reader

It seems [1] recent kernels are not affected by this. So if you are running older (hopefully lts kernels), you might need to verify them, otherwise you should be fine (check back with your distro obviously).

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

View on HN

Correction: ALL production OS and kernels are affected.

"udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]"

There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.

Servers are usually on LTS versions. Ubuntu 16.04 is on 4.4 last time I checked. My Android 7.0 phone is on 3.10.84, last updated in February.

Edit: Ubuntu's tracker is at https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...

Patches from upstream are regularly backported by distribution vendors, including Redhat, Debian, Ubuntu (though I don't know if Ubuntu do this themselves or base on Debian). Anyway, looking at the version number is not enough, you should refer your vendor security advisories.

Arch is on 4.10.9

Yes but arch is not a serious production/server os. Although some of you may do it.

Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.

That just goes to show that Ubuntu and friends are not serious production OS. In what world is extended vulnerability to months-old bugs a legitimate prerequisite for production viability?

This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.

Is it confirmed that kernels before 3.19 are safe?

The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare:

http://lxr.free-electrons.com/source/net/core/datagram.c?v=3...

http://lxr.free-electrons.com/source/net/core/datagram.c?v=4...

I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that?

EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.

Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.

> Correction: ALL production OS and kernels are affected.

No, ALL production OS backport security patches to their kernels. This bug was fixed in Debian 15 months ago and Debian stable kernel is way older than 4.5.

> "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" > There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

Kernel version is meaningless, see above.

which is not really cool I mean I at least need to check two kernels:

- Linux git 4.4.0-72-generic #93-Ubuntu SMP Fri Mar 31 14:07:41 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (Ubuntu 16.04, but I can probably switch to HWE) - Linux censored 3.10.0-514.6.1.el7.x86_64 #1 SMP Wed Jan 18 13:06:36 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (CentOS 7.3.1611)

not really cool :/

happily I have no udp traffic and the AWS/internal firewall blocks all udp traffic by default.

https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...

Apparently xenial 4.4 is not affected.

Reply on news.ycombinator.com