Debian releases fix for Linux kernel 2.6.8 vulnerabilities

newsguy 0 424 Views

As reported here last week, three security flaws had been discovered that impacted upon the 2.6.x Kernel. A NULL-pointer dereference within netfilter when handling SCTP connections with unknown chunk types that could be exploited to crash the kernel; a cpuset_task_read() function in /kernel/cpuset.c which had an underflow error that could potentially be exploited in order to read the kernel memory; and a problem whereby the kernel itself mishandled seeds for random number generation, potentially weakening application security for those programs relying upon secure random number generation.

Well according to the mailing list these have now been fixed with the release of numerous updates for Linux kernel 2.6.8 as detailed in Debian Security Advisory .

The latest update also fixes a number of other problems, such as the regression in the smbfs subsystem introduced in DSA-1233 causing symlinks to be interpreted as regular files.

Debian recommend that you upgrade your kernel package immediately and reboot the machine, and if you have built a custom kernel from the kernel source package that you rebuild to take advantage of the new fixes.

Just to help, the upgrade instructions are:

wget url (to fetch the file for you)
dpkg -i file.deb (to install the referenced file)

And for those of you using the apt-get package manager:

apt-get update (to update the internal database)
apt-get upgrade (to install corrected packages)

Dani AI

Generated

As reported, Debian has pushed fixed 2.6.8 kernel packages; this short note adds practical verification steps, a safe rebuild workflow for custom kernels, and quick post-upgrade checks that weren't shown in the OP. It assumes the reader wants to confirm a system is patched and, when necessary, produce a new Debian-style kernel package that picks up the fixes without breaking third‑party modules.

Quick verification (no package upgrades shown here):

uname -r
dpkg -l 'linux-image-*'
zless /usr/share/doc/linux-image-*/changelog.Debian.gz

Use uname -r to read the running kernel, dpkg -l to list installed kernel packages, and inspect the Debian changelog for the kernel package to confirm the security entries are present.

Safe rebuild checklist for custom kernels (outline):

# in kernel source tree
cp /boot/config-$(uname -r) .config
make oldconfig
# build Debian binary packages (kernel-package provided)
fakeroot make-kpkg --initrd --revision=1.custom kernel_image kernel_headers
# the generated .deb files appear in the parent dir

Keep the current config, run make oldconfig to replay local choices, and build .deb packages so installation integrates with Debian's package database. Install the resulting .deb with the system package tools and schedule a reboot in a maintenance window.

Post-update checks and cautions:

lsmod
dkms status
modinfo <third-party-module>

Rebuild or reinstall out‑of‑tree modules (NVIDIA, VMware, etc.) so they match the new kernel ABI; check services that touch kernel subsystems for regressions. For production systems, test the new kernel on a staging host (or with a snapshot/backup) before rolling changes widely.

Member Avatar for Sturm
Sturm 270 Veteran Poster

[edit]

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview