Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 14 Aug 2007 18:52:21 +0400
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com
Subject: [openwall-announce] Linux 2.4.35-ow2

Hi,

I've just put out the Linux 2.4.35-ow2 patch.

The patch is available at the usual location:

	http://www.openwall.com/linux/

This revision adds a fix for the "parent process death signal"
vulnerability in the Linux kernel discovered by Wojciech Purczynski of
COSEINC PTE Ltd. and iSEC Security Research (CVE-2007-3848).  The impact
of this vulnerability depends on the Linux distribution used and SUID
programs installed.  On Owl with no added SUID programs, this should be
a non-issue.

Linux 2.4.35-ow2 also adds two security hardening features, both enabled
by default: restricted access to VM86 mode (specific to 32-bit x86) and
restricted zero page mappings (generic).  The latter one is fairly
important and it may be a primary reason to update to 2.4.35-ow2.  It is
supposed to reduce the impact of an entire class of very common kernel
bugs.  The downsides are that it has to try to cover all ways in which
the zero page may be mapped (and it might miss some) in order to be
non-intrusive and have no performance impact, and that it might break
some uses of programs such as dosemu and Wine (although Wine works for
me even with 2.4.35-ow2 and the new restrictions enabled, running as
non-root indeed - but I only use a handful of Win32 apps).  Of course,
these days Linux 2.4 kernels and especially -ow patches are primarily
aimed at servers, where dosemu and Wine are irrelevant.

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ