Re: Kernel Vulnerabilities

[Christophe Chisogne <christophe@publicityweb.com>]

David Ramsden a écrit :
> On Sat, Nov 13, 2004 at 04:41:00PM -0800, peace bwitchu wrote:
>
> > http://securitytracker.com/alerts/2004/Nov/1012165.html
>
> PoC for the first one is at:
> http://www.k-otik.com/exploits/20041111.elfdump.c.php
>
> There is a reference in the changelog for 2.4.28-rc3:
>    "binfmt_elf: handle partial reads gracefully"

Fixed by debian patch 097-elf_loader_overflow-1.diff.bz2, which is
included in kernel-source-2.4.27-6 (and corresp. kernel-image debs).

Cfr "Fix multiple vulnerablilities in the ELF loader. (Simon Horman)"
in 2.4.27-6 kernel-source changelog
http://packages.debian.org/changelogs/pool/main/k/kernel-source-2.4.27/kernel-source-2.4.27_2.4.27-6/changelog

Christophe