CVE-2012-0056
Debian says this is fixed:
I am vulnerable:
(download code to a.c; make a.c; ./a)
(nice instructions here:
I would like to fix/patch this, but am not quite sure what to do.
16 Replies
32-bit: "Latest 3.0 (3.0.17-linode41)"
64-bit: "Latest 3.2 (3.2.1-x86_64-linode23)"
Simply select the respective kernel for your Linode in the configuration profile and reboot.
-Tim
So don't freak out if the test says you're "vulnerable" on a patched kernel.
It's as easy as
1) Edit
2) Save
3) Reboot
I second the notion of a security email.
As for the code, seem right. After the reboot, it still told me i was vulnerable.
uname -r - >3.0.17-linode41
@chacham:
I second the notion of a security email.
Linode is an unmanaged service – it's up to us to keep an eye on this sort of thing. Subscribe to this:. www.linode.com/kernels/rss.xml
The RSS feed doesn't mention severity. I understand it doesn't have to. But it'd be nice to have a list (or even this or another RSS feed) to bring critical patches to mind.
@pclissold:
@chacham:I second the notion of a security email.
Linode is an unmanaged service – it's up to us to keep an eye on this sort of thing. Subscribe to this:. www.linode.com/kernels/rss.xml
Perhaps Linode should then also remove these useful services:
Those are on-demand, automated features that let us manage our 'nodes ourselves, not services they perform for us. Would it be nice if they provided a notice? Sure, but not everyone can change kernels without testing software first. And not everyone wants Linode tracking what they're doing with their Linode Internet Storm Center
A wish, that's all.
@chacham:
Note, that even if we know of the vulnerabilities, we can't do anything without a kernel available here. Hence, they have to fix it. So, if they do, it'd be nice if they told us about it.
A wish, that's all.
That's incorrect. You can load whatever kernel you want, so you can do something, and they don't have to fix it for you to be protected.
@chacham:
Hmm… i assumed wrongly then. i thought the reason for the -linode kernels was that they were required.
They're convenient. They're automatically the latest approved kernel from Linode, so a simple reboot is often enough to get you the latest approved kernel. They've got a configuration set that's optimally compatible with linodes (although mistakes have been known to be made). It's a "set it and forget it" kind of thing.
You can, however, load whichever kernel you want by selecting the pv-grub option. When that's selected, Xen will boot your linode with whichever the default kernel you've configured grub to use.
Some people on linode even use ksplice to get kernel updates without rebooting, although I don't know what the situation with ksplice is after they were bought out by Oracle. They seem to still be offering service for Ubuntu and Fedora, but have dropped support for everything else, and it may only be a matter of time before everything but Oracle Linux gets dropped.
