[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0610241d156806108139c9055b210bcfd4a7c554.camel@thirddimension.net>
Date: Sun, 03 May 2026 11:50:27 -0400
From: Reid Sutherland <reid@...rddimension.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2026-31431: CopyFail: linux local
privilege scalation
On Sun, 2026-05-03 at 07:43 +1000, Brian May wrote:
> Reid Sutherland <reid@...rddimension.net> writes:
>
> > I'm assuming any thoroughly qualified platform engineer compiles
> > the
> > host kernel without module support. At least, that needs to make a
> > comeback, bring back applying grsec patches and make menuconfig..
>
> Kernel modules here are good, not bad. If everything was compiled
> into
> the kernel it would be harder to solve this sort of security issue.
>
Yeah but there's a series of problems here, like autoloading modules on
a server that doesn't change.
Thinking about the math functions, there's a good benefit in the kernel
carrying common interfaces for functions they have already solved. But
we need a new unprivileged layer in the kernel, like a library layer,
if this is desired.
Microsoft had to rework the kernel security after Crowdstrike ruined
everything with that ridiculous outage.
> In this case, it often just meant disabling the module that often
> wasn't
> even loaded. The only exception was if I tested the vulnerabilty
> before
> hand :-). Even then, easy to unload the module and disable it.
>
> But I heard some enterprise kernels came with the code compiled into
> the
> kernel, and these required a kernel command line option and a reboot
> to
> fix.
>
> Of course, maybe there is the argument that only the things you need
> should be enabled; but this would be a lot harder for distros to keep
> everyone happy. Maybe an argument for building your own custom
> kernels
> not relying on distro kernels.
Yeah that would be it. You boot with the default kernel and then build
your system specific kernel.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
