Hacker News Reader

Hacker News

Comment by user5994461 | Hacker News Reader

Parent Full thread

user5994461

Correction: ALL production OS and kernels are affected.

"udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]"

There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

View on HN

This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.

Is it confirmed that kernels before 3.19 are safe?

The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare:

http://lxr.free-electrons.com/source/net/core/datagram.c?v=3...

http://lxr.free-electrons.com/source/net/core/datagram.c?v=4...

I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that?

EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.

Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.

Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.

Servers are usually on LTS versions. Ubuntu 16.04 is on 4.4 last time I checked. My Android 7.0 phone is on 3.10.84, last updated in February.

Edit: Ubuntu's tracker is at https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...

Patches from upstream are regularly backported by distribution vendors, including Redhat, Debian, Ubuntu (though I don't know if Ubuntu do this themselves or base on Debian). Anyway, looking at the version number is not enough, you should refer your vendor security advisories.

> Correction: ALL production OS and kernels are affected.

No, ALL production OS backport security patches to their kernels. This bug was fixed in Debian 15 months ago and Debian stable kernel is way older than 4.5.

> "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" > There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

Kernel version is meaningless, see above.

Arch is on 4.10.9

Yes but arch is not a serious production/server os. Although some of you may do it.

Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.

That just goes to show that Ubuntu and friends are not serious production OS. In what world is extended vulnerability to months-old bugs a legitimate prerequisite for production viability?

Reply on news.ycombinator.com