Date: Tue, 14 Aug 2007 18:52:21 +0400 From: Solar Designer <solar@...nwall.com> To: announce@...ts.openwall.com Subject: [openwall-announce] Linux 2.4.35-ow2 Hi, I've just put out the Linux 2.4.35-ow2 patch. The patch is available at the usual location: http://www.openwall.com/linux/ This revision adds a fix for the "parent process death signal" vulnerability in the Linux kernel discovered by Wojciech Purczynski of COSEINC PTE Ltd. and iSEC Security Research (CVE-2007-3848). The impact of this vulnerability depends on the Linux distribution used and SUID programs installed. On Owl with no added SUID programs, this should be a non-issue. Linux 2.4.35-ow2 also adds two security hardening features, both enabled by default: restricted access to VM86 mode (specific to 32-bit x86) and restricted zero page mappings (generic). The latter one is fairly important and it may be a primary reason to update to 2.4.35-ow2. It is supposed to reduce the impact of an entire class of very common kernel bugs. The downsides are that it has to try to cover all ways in which the zero page may be mapped (and it might miss some) in order to be non-intrusive and have no performance impact, and that it might break some uses of programs such as dosemu and Wine (although Wine works for me even with 2.4.35-ow2 and the new restrictions enabled, running as non-root indeed - but I only use a handful of Win32 apps). Of course, these days Linux 2.4 kernels and especially -ow patches are primarily aimed at servers, where dosemu and Wine are irrelevant. -- Alexander Peslyak <solar at openwall.com> GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15 http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.