Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 8 Jul 2014 18:23:42 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2014-4699: Linux ptrace bug

On Sat, Jul 05, 2014 at 10:25:47PM +0400, Solar Designer wrote:
> Here are some distro vendor status pages on this bug:
> 
> "x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX (CVE-2014-4699)"
> https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1337339
> 
> Ubuntu has just sent out 7 update announcements (for different of their
> supported distros/kernels), USN-2266-1 through USN-2272-1.

and USN-2274-1

> "ptrace,x86: force IRET path after a ptrace_stop()"
> http://kernel.opensuse.org/cgit/kernel/commit/?h=openSUSE-13.1&id=d1f26676dad578a65c94782f0c2bd00b7aa68f1b
> 
> "CVE-2014-4699 Kernel: x86_64,ptrace: Enforce RIP <= TASK_SIZE_MAX"
> https://bugzilla.redhat.com/show_bug.cgi?id=1115927

Some more:

"FS#41115 - [linux] [linux-lts] CVE-2014-4699 ptrace vulnerability"
https://bugs.archlinux.org/task/41115?project=1

"CVE-2014-4699"
https://security-tracker.debian.org/tracker/CVE-2014-4699

"KernelCare update for local privilege escalation CVE-2014-4699"
http://www.cloudlinux.com/blog/clnews/kernelcare-update-for-local-privilege-escalation-cve20144699.php

"CentOS 6, RHEL 6, CL 6 & OpenVZ can now be patched against
CVE-2014-4699. The patched kernels are yet to be available from the
vendors. Yet, due to the nature of the issue, we wanted to release the
patch as soon as possible"

Just tracking how quickly distros patch a critical issue for which
there's no published exploit yet.

Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.