Date: Tue, 8 Jul 2014 18:23:42 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: CVE-2014-4699: Linux ptrace bug On Sat, Jul 05, 2014 at 10:25:47PM +0400, Solar Designer wrote: > Here are some distro vendor status pages on this bug: > > "x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX (CVE-2014-4699)" > https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1337339 > > Ubuntu has just sent out 7 update announcements (for different of their > supported distros/kernels), USN-2266-1 through USN-2272-1. and USN-2274-1 > "ptrace,x86: force IRET path after a ptrace_stop()" > http://kernel.opensuse.org/cgit/kernel/commit/?h=openSUSE-13.1&id=d1f26676dad578a65c94782f0c2bd00b7aa68f1b > > "CVE-2014-4699 Kernel: x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX" > https://bugzilla.redhat.com/show_bug.cgi?id=1115927 Some more: "FS#41115 - [linux] [linux-lts] CVE-2014-4699 ptrace vulnerability" https://bugs.archlinux.org/task/41115?project=1 "CVE-2014-4699" https://security-tracker.debian.org/tracker/CVE-2014-4699 "KernelCare update for local privilege escalation CVE-2014-4699" http://www.cloudlinux.com/blog/clnews/kernelcare-update-for-local-privilege-escalation-cve20144699.php "CentOS 6, RHEL 6, CL 6 & OpenVZ can now be patched against CVE-2014-4699. The patched kernels are yet to be available from the vendors. Yet, due to the nature of the issue, we wanted to release the patch as soon as possible" Just tracking how quickly distros patch a critical issue for which there's no published exploit yet. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.