[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070814145221.GA755@openwall.com>
Date: Tue, 14 Aug 2007 18:52:21 +0400
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com
Subject: [openwall-announce] Linux 2.4.35-ow2
Hi,
I've just put out the Linux 2.4.35-ow2 patch.
The patch is available at the usual location:
http://www.openwall.com/linux/
This revision adds a fix for the "parent process death signal"
vulnerability in the Linux kernel discovered by Wojciech Purczynski of
COSEINC PTE Ltd. and iSEC Security Research (CVE-2007-3848). The impact
of this vulnerability depends on the Linux distribution used and SUID
programs installed. On Owl with no added SUID programs, this should be
a non-issue.
Linux 2.4.35-ow2 also adds two security hardening features, both enabled
by default: restricted access to VM86 mode (specific to 32-bit x86) and
restricted zero page mappings (generic). The latter one is fairly
important and it may be a primary reason to update to 2.4.35-ow2. It is
supposed to reduce the impact of an entire class of very common kernel
bugs. The downsides are that it has to try to cover all ways in which
the zero page may be mapped (and it might miss some) in order to be
non-intrusive and have no performance impact, and that it might break
some uses of programs such as dosemu and Wine (although Wine works for
me even with 2.4.35-ow2 and the new restrictions enabled, running as
non-root indeed - but I only use a handful of Win32 apps). Of course,
these days Linux 2.4 kernels and especially -ow patches are primarily
aimed at servers, where dosemu and Wine are irrelevant.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
