Re: Question on CVE-2017-5754 on Debian 8.9

[Michael Lange <klappnase@freenet.de>]

Hi,

On Thu, 25 Jan 2018 09:15:59 +0000
Michael Fothergill <michael.fothergill@gmail.com> wrote:

> >
> >
> > I have the same problem as in Gentoo.
> >
> > In order to install gcc 7.3 rc2 I think I would need to be sid.
> >
> >
> > I don't think I want to be sid at present.
> >
> 
> ​But if I did want to be sid, would a source file like this suffice:
> 
> ​
> deb http://http.us.debian.org/debian/ unstable main contrib non-free
> deb-src http://http.us.debian.org/debian/ unstable main contrib non-free
> 
> ​or do I need more?
> 
> ​If I become sid then I think I would just install the gcc version above
> the one I have and  then reinstall
> the 4.15.0 kernel and maybe I would have the full kernel
> patch.............

hmm, I don't think installing the latest compiler does any good if you
install a kernel package that was compiled with an older compiler version.

And from a quick glance it looks like sid still has only gcc-7.2 .
There is a gcc-8 package in experimental though; from again a quick
glance at the dependencies it surely won't easily install on stretch but
it might be worth a try if it installs on buster.
Then I guess you would have to compile the kernel from source, which
actually isn't too hard with make-kpkg (however I never tried to force
make-kpkg to use a certain, non-system-default compiler, but that's surely
possible).

Regards

Michael


.-.. .. ...- .   .-.. --- -. --.   .- -. -..   .--. .-. --- ... .--. . .-.

Every living thing wants to survive.
		-- Spock, "The Ultimate Computer", stardate 4731.3