Date: Thu, 17 Nov 2016 14:32:13 +0100 From: Solar Designer <solar@...nwall.com> To: Alan Williams <ajw@...blue.net.au> Cc: owl-users@...ts.openwall.com Subject: Re: How can I upgrade this against C.O.W. on Owls with kernel version 2.6.18-194.11.3.el5.028stab071.5.owl1 Hi Alan, On Thu, Nov 17, 2016 at 05:02:59PM +1100, Alan Williams wrote: > I have found a number of owl installs in the infrastructure I now manage and > I am wondering how to deal with them in respect of the dirty c.o.w. > vulnerability, given that they are all quite old. > > The four machines list the following two kernel versions: > > 2.6.18-194.11.3.el5.028stab071.5.owl1 #1 SMP Sat Sep 25 02:43:36 MSD 2010 > x86_64 GNU/Linux > > 2.6.18-348.3.1.el5.028stab106.2.owl1 #1 SMP Mon Apr 8 03:39:13 MSK 2013 > x86_64 GNU/Linux Our kernel packages from Owl 3.1-stable should install and work in replacement of the above. (The packages from Owl-current are essentially the same, and might also work for you, but they require Owl 3.0+'s support of xz compression in RPM, so won't install on pre-3.0 systems. I don't know how old the userlands on your machines are, so going with 3.1-stable's packages is a safer bet.) You may download them from here: https://mirrors.kernel.org/openwall/Owl/3.1-stable/x86_64/RPMS/ 2.6.18-408.el5.028stab120.1.owl4 is the version you currently need, or whatever will be latest by the time you approach these upgrades. We have some instructions here: http://openwall.info/wiki/Owl/upgrade#Upgrade-the-kernel When upgrading the machines with the -194 kernel, please note this change: * Sun Oct 09 2011 Solar Designer <solar-at-owl.openwall.com> 2.6.18-274.3.1.el5.028stab094.3.owl1 [...] - Moved some OpenVZ features to modules like it is done in OpenVZ's official kernel builds. This means that if you use OpenVZ containers on that machine, you need to also upgrade vzctl, for this change: * Sun Oct 09 2011 Solar Designer <solar-at-owl.openwall.com> 3.0.23-owl7 - No longer set MODULES_DISABLED=yes in the default config since our new kernels use modules for OpenVZ stuff just like OpenVZ's official kernels do. and make sure /etc/vz/vz.conf gets updated accordingly (or just edit it manually). I hope this helps. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.