News for hackers. Stuff that matters.

A comment on CVE-2016-2384: arbitrary code execution due to a bug in usb-midi linux driver. Parent comment

Re:CVE-2016-2384: arbitrary code execution due to a bug in u... by contingencies on Monday February 22, 2016 @10:45PM (#11156357)
My point was not just to disable modules, but to disable all kinds of unrequired kernel functionality. Recall recent vulnerabilities such as BPF JIT spraying, etc.
[ Parent | on HN ]
Re:CVE-2016-2384: arbitrary code execution due to a bug in u... by geofft on Monday February 22, 2016 @10:57PM (#11156412)
Yeah, a hardened kernel is great and I'm glad to see distros building kernels just for security-sensitive server applications.

However, setting kernel.modprobe to /bin/false is extremely high-impact in reduction of attack surface compared to how much effort it is (one line in /etc/sysctl.d/); you can keep running a full-featured distribution kernel, even one from Fedora or Ubuntu that's simultaneously intended for desktop use.

[ Parent | on HN ]