Re:Linux af_packet.c race condition local root exploit
by fulafel on Tuesday December 06, 2016 @03:19AM
(#13113043)
Also, be careful about turning that off on Ubuntu if using Canonical's live patching - that is built on snaps and requires user namespaces.
Re:Linux af_packet.c race condition local root exploit
by burgerLife on Tuesday December 06, 2016 @01:44AM
(#13112706)
It has been fixed in Ubuntu and OpenVZ:
Re:Linux af_packet.c race condition local root exploit
by zoobab on Tuesday December 06, 2016 @03:30AM
(#13113093)
In Virtuozzo at least. They don't mention OpenVZ.
Re:Linux af_packet.c race condition local root exploit
by etcet on Tuesday December 06, 2016 @11:00AM
(#13115542)
As many people found out with Dirty COW, the latest version of OpenVZ doesn't receive tested patched kernels in response to newly discovered bugs. Their options are to run a nightly kernel build or to pay for Virtuozzo for their 'ReadyKernel' patches:
"Virtuozzo team uploads stable kernels for OpenVZ version 7, tested for our commercial customers, approximately once a quarter. In between, we do not test or release any kernels - all the intermediate updates are delivered to our commercial customers in rebootless (kpatch) format without building full kernel updates. Again, this is a part of our commercial offering.
As for the contributions to the community product, we still build these kernels for the "factory" repository. However, we are not equipped to test them on regular basis, between these quarterly updates."
"Non-privileged user namespaces disabled by default, only vulnerable with sysctl kernel.unprivileged_userns_clone=1"
But: ... on systems where unprivileged namespaces are enabled (Ubuntu, Fedora, etc).
Interesting that Ubuntu and Debian differ here.
As of right now it doesn't appear that any distribution has fixed this yet, which is odd since it was fixed upstream a week ago.