[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140708142342.GA10522@openwall.com>
Date: Tue, 8 Jul 2014 18:23:42 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2014-4699: Linux ptrace bug
On Sat, Jul 05, 2014 at 10:25:47PM +0400, Solar Designer wrote:
> Here are some distro vendor status pages on this bug:
>
> "x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX (CVE-2014-4699)"
> https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1337339
>
> Ubuntu has just sent out 7 update announcements (for different of their
> supported distros/kernels), USN-2266-1 through USN-2272-1.
and USN-2274-1
> "ptrace,x86: force IRET path after a ptrace_stop()"
> http://kernel.opensuse.org/cgit/kernel/commit/?h=openSUSE-13.1&id=d1f26676dad578a65c94782f0c2bd00b7aa68f1b
>
> "CVE-2014-4699 Kernel: x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX"
> https://bugzilla.redhat.com/show_bug.cgi?id=1115927
Some more:
"FS#41115 - [linux] [linux-lts] CVE-2014-4699 ptrace vulnerability"
https://bugs.archlinux.org/task/41115?project=1
"CVE-2014-4699"
https://security-tracker.debian.org/tracker/CVE-2014-4699
"KernelCare update for local privilege escalation CVE-2014-4699"
http://www.cloudlinux.com/blog/clnews/kernelcare-update-for-local-privilege-escalation-cve20144699.php
"CentOS 6, RHEL 6, CL 6 & OpenVZ can now be patched against
CVE-2014-4699. The patched kernels are yet to be available from the
vendors. Yet, due to the nature of the issue, we wanted to release the
patch as soon as possible"
Just tracking how quickly distros patch a critical issue for which
there's no published exploit yet.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
