Date: Tue, 25 Aug 2009 12:59:36 +0400 From: Solar Designer <solar@...nwall.com> To: announce@...ts.openwall.com, owl-users@...ts.openwall.com Subject: [openwall-announce] Linux 22.214.171.124-ow1; new Owl ISOs Hi, A couple of days ago, I've released a new revision of the kernel patch, updated to Linux 126.96.36.199: http://www.openwall.com/linux/ (and I similarly released updates to all other minor revisions of Linux 2.4.37.x before, some of which I neglected to announce in here). The important security-relevant changes made in the 2.4.37.x kernels and in the -ow patches are briefly described in news items on the above web page. Specifically, the 188.8.131.52 kernel adds a fix for a NULL pointer dereference bug (which, as far as I'm aware, was not exploitable into privilege escalation as long as the vm.mmap_min_addr restriction was enabled and working), whereas the -ow patch to it adds a fix for a local information leak affecting 64-bit kernel builds (not yet fixed upstream in 2.4, will likely be fixed in the next upstream revision). 184.108.40.206-ow1 and then 220.127.116.11 introduced a hardening measure against a vm.mmap_min_addr bypass that could have worked via a combination of the "personality" feature and certain improperly designed SUID-root programs (only one example is known to me so far - pulseaudio). As far as I'm aware, on 2.4 kernels this bypass could have worked on x86_64 kernel builds, but not on most/all other architectures (including definitely not on 32-bit x86 builds). Finally, the 18.104.22.168 kernel release added the "-fno-delete-null-pointer-checks" option to gcc invocations, which was important to reduce the impact of a class of kernel bugs (which are yet to be found and fixed individually, but are known to exist in general) and added several security-relevant fixes to the RTL-8169 NIC driver. (Linux 22.214.171.124-ow1 and earlier were announced in here before, so I'll stop documenting the changes at this point.) There are new ISO images of Owl-current (for x86 and x86-64) available on our FTP mirrors: http://www.openwall.com/Owl/DOWNLOAD.shtml -rw-r--r-- 1 ftp ftp 449344077 Aug 23 06:44 Owl-current-20090823-i586.iso.gz -rw-r--r-- 1 ftp ftp 452960143 Aug 23 10:00 Owl-current-20090823-x86_64.iso.gz These use the Linux 126.96.36.199-ow1 kernel, and they contain various package updates that we made lately: http://www.openwall.com/Owl/CHANGES-current.shtml We've been generating new Owl-current ISOs every 1-2 weeks lately. Since the last one I announced in here, we've made major changes to our packages of vsftpd, BIND, chkconfig, groff, logrotate, mktemp, findutils, tar - as well as minor changes to other packages and parts of Owl - and indeed we've updated the kernel. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.