[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20161117133213.GA6908@openwall.com>
Date: Thu, 17 Nov 2016 14:32:13 +0100
From: Solar Designer <solar@...nwall.com>
To: Alan Williams <ajw@...blue.net.au>
Cc: owl-users@...ts.openwall.com
Subject: Re: How can I upgrade this against C.O.W. on Owls with kernel version 2.6.18-194.11.3.el5.028stab071.5.owl1
Hi Alan,
On Thu, Nov 17, 2016 at 05:02:59PM +1100, Alan Williams wrote:
> I have found a number of owl installs in the infrastructure I now manage and
> I am wondering how to deal with them in respect of the dirty c.o.w.
> vulnerability, given that they are all quite old.
>
> The four machines list the following two kernel versions:
>
> 2.6.18-194.11.3.el5.028stab071.5.owl1 #1 SMP Sat Sep 25 02:43:36 MSD 2010
> x86_64 GNU/Linux
>
> 2.6.18-348.3.1.el5.028stab106.2.owl1 #1 SMP Mon Apr 8 03:39:13 MSK 2013
> x86_64 GNU/Linux
Our kernel packages from Owl 3.1-stable should install and work in
replacement of the above. (The packages from Owl-current are
essentially the same, and might also work for you, but they require
Owl 3.0+'s support of xz compression in RPM, so won't install on pre-3.0
systems. I don't know how old the userlands on your machines are, so
going with 3.1-stable's packages is a safer bet.)
You may download them from here:
https://mirrors.kernel.org/openwall/Owl/3.1-stable/x86_64/RPMS/
2.6.18-408.el5.028stab120.1.owl4 is the version you currently need, or
whatever will be latest by the time you approach these upgrades.
We have some instructions here:
http://openwall.info/wiki/Owl/upgrade#Upgrade-the-kernel
When upgrading the machines with the -194 kernel, please note this change:
* Sun Oct 09 2011 Solar Designer <solar-at-owl.openwall.com> 2.6.18-274.3.1.el5.028stab094.3.owl1
[...]
- Moved some OpenVZ features to modules like it is done in OpenVZ's official
kernel builds.
This means that if you use OpenVZ containers on that machine, you need
to also upgrade vzctl, for this change:
* Sun Oct 09 2011 Solar Designer <solar-at-owl.openwall.com> 3.0.23-owl7
- No longer set MODULES_DISABLED=yes in the default config since our new
kernels use modules for OpenVZ stuff just like OpenVZ's official kernels do.
and make sure /etc/vz/vz.conf gets updated accordingly (or just edit it
manually).
I hope this helps.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
