Linux Kernel 2.6.x vulnerabilities

newsguy 0 Tallied Votes 350 Views Share

According to postings at concerning a report by Vilmos Nebehaj which was consequently signed off by Linus Torvalds and Chris Wright, the Linux Kernel 2.6.x has multiple security vulnerabilities.

Well, to be precise, two vulnerabilities and what is described as a ‘weakness’ which are capable of being exploited by a malicious local user who could, under the right circumstances, reveal personal information as well as instigate a Denial of Service attack.

The three security flaws are as follows:

  • A NULL-pointer dereference within netfilter when handling SCTP connections with unknown chunk types can be exploited to crash the kernel, hence the DoS attack vulnerability.
  • The cpuset_task_read() function in /kernel/cpuset.c has an underflkow error which could potentially be exploited in order to read the kernel memory, hence the personal information disclosure vulnerability.
  • A problem whereby the kernel itself mishandles seeds for random number generation, potentially weakening application security for those programs relying upon secure random number generation, which is described as a weakness although I am more inclined to lump it right into the whole vulnerability basket as it sure makes those applications so impacted rather vulnerable.

And the recommended solution would be? Yep, you guessed it, updating to Linux Kernel version

jbennet 1,618 Most Valuable Poster Team Colleague Featured Poster

do you reackon 2.8 willl ever come out?

and what about all the "stable" distros using 2.4? will they get fixes backported?

Sturm 270 Veteran Poster

Darn it, im using

John A 1,896 Vampirical Lurker Team Colleague

>do you reackon 2.8 willl ever come out?
It's going to be a while because of the bugs that they keep continually finding in the kernel. Not too long ago Linus Torvals is quoted saying that they might have to do a whole bug fixing release cycle because of the vulnerabilities that are creeping into the kernel. Once they iron out these creases, I'm sure the release of the 2.8 kernel won't be too far away.

Marks256 0 Junior Poster

Well it is still more secure than Window$

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.