Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 6 Jun 2014 11:11:42 +0200
From: rf@...eap.de
To: Thomas Gleixner <tglx@...utronix.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: Linux kernel futex local privilege escalation
	(CVE-2014-3153)

>>>>> "Thomas" == Thomas Gleixner <tglx@...utronix.de> writes:

Hi Thomas,

    >> On Thu, Jun 05, 2014 at 11:38:27PM -0400, Rich Felker wrote:
    >> > On Thu, Jun 05, 2014 at 06:45:45PM +0400, Solar Designer wrote:
    >> > > I've attached patches by Thomas Gleixner (four e-mails, in
    >> > > mbox format), as well as back-ports of those by John Johansen
    >> > > of Canonical, who wrote:
    >> >
    >> > Maybe I'm missing something, but I can't find any statement of
    >> > what version these patches are intended to apply cleanly
    >> > to. They don't apply to latest stable.
    >>
    >> Thomas - can you answer Rich's question?  This is about patches
    >> you sent on June 3 to linux-distros, which Kees then saved into
    >> an mbox file.

    Thomas> They should apply cleanly, if all stable tagged futex
    Thomas> patches before that are applied.

could you please clarify whether

f0d71b3dcb8332f7971b5f2363632573e6d9486a futex: Prevent attaching to kernel threads
866293ee54227584ffcb4a42f69c1f365974ba7f futex: Add another early deadlock detection check

absolutely have to be applied as well for the CVE's to be fixed and
functionality being OK otherwise? I need to backport to 3.12.x. The patches
for 3.13 sent by Alexander applied cleanly to latest 3.12.

Thanks,

Roland

-------
http://www.q-leap.com / http://qlustar.com

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ