Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 21 Mar 2003 20:30:45 +0300
From: Solar Designer <>
Subject: Linux 2.2.25-ow1


Linux 2.2.25-ow1 is out and a part of Owl-current.  The download URL
for -ow patches is:

Linux 2.2.25 fixes the kmod/ptrace race condition vulnerability
discovered by Andrzej Szombierski.  The vulnerability could result in
a local root compromise if the kernel is built with support for
auto-loading modules (CONFIG_KMOD) and the path to a module loader
program is specified in /proc/sys/kernel/modprobe.  It is recommended
that you not enable or use kmod, for both security and reliability
reasons.  The kernels used on Owl CDs have never been built with
support for kmod.  Owl startup scripts, unlike those used on some
other distributions, don't setup a path to modprobe with the kernel.

Linux 2.2.24+ also corrects "Etherleak" issues with a number of
Ethernet drivers (a common class of vulnerabilities publicized by Ofir
Arkin and Josh Anderson of @stake) and a local DoS vulnerability with
mmap(2) of /proc/<pid>/mem files discovered by Michal Zalewski of

Finally, Linux 2.2.25-ow1 patch makes the added RLIMIT_NPROC
enforcement also work for 32-bit syscalls on sparc64 (thanks to Brad
Spengler for noticing that this was missing).

For those who are wondering about 2.4.x, I am going to put out a new
version of the patch when 2.4.21 comes out.  Meanwhile, if you must
use 2.4.x for whatever reason, make sure you aren't using kmod.

Some references for the Linux kernel vulnerabilities I've mentioned:

The kmod/ptrace race:


mmap(2) of /proc/<pid>/mem DoS:


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.