Date: Fri, 6 Jun 2014 17:43:28 +0200 From: rf@...eap.de To: oss-security@...ts.openwall.com Subject: Re: Linux kernel futex local privilege escalation (CVE-2014-3153) >>>>> "Greg" == Greg KH <greg@...ah.com> writes: >> Thanks for the reply. I did read your earlier message. To answer >> your question: I only apply patches that are absolutely necessary >> to fix a known problem. Greg> "known problem" to whom? :) To the people on oss-security e.g? Published CVEs and obviously problems we experience on our installations. Greg> With that kind of attitude, you are going to miss a lot of Greg> valuable kernel fixes for issues. I'd recommend using a Greg> stable kernel release instead, but hey, it's your systems... Probably something to tell Red Hat as well. They are still on 2.6.32 :) But they have their reasons just as we have ours ... >> Want to make sure the changed stuff doesn't lead to a regression >> somewhere else. Greg> Nothing is ever "sure" in software. That's not totally new to me :) So let's say "as sure as possible". >> Futex stuff is a central component in the kernel ... I can't >> judge about any possible side effects from reading the code ... >> and this kernel is going on a number of production clusters. Greg> Test it out first, like you should any update. There are Greg> futex test suites out there, run them yourself to verify that Greg> nothing is broken. As for if it fixes potentially future Greg> problems that others might not know about, well, that's a Greg> gamble on everyone's part, right? Right. Thanks for the hint with the test suites. Will try them out. >> Anyway, I've applied all the (2+4) patches to our 3.12. Greg> Why are you "stuck" at 3.12? We need quite a bit of out-of-kernel.org stuff. Without staying on a fixed release for some time, this is non-maintainable. Greg> There is someone still maintaining 3.12-stable, why not rely Greg> on those releases if you want that kernel version, instead of Greg> rolling your own? We thankfully do rely on that as our base. In this case though, the patches haven't been ported until this moment. And I can't wait for them to appear since there is no time-line when that will happen ... Thanks for your comments, Roland ------- http://www.q-leap.com / http://qlustar.com --- HPC / Storage / Cloud Linux Cluster OS ---
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.