dirty-pipe ?
Greetings all;
Is this kernel vulnerable?
4.19.71-rt24-v7l+ #1 SMP PREEMPT RT Thu Feb 6 07:09:18 EST 2020 armv7l GNU/Linux
If so, link to update patch please
Thank you.
Cheers, Gene Heskett.
Signature · 5 lines
"There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author, 1940) If we desire respect for the law, we must first make the law respectable. - Louis D. Brandeis
Quoted 6 lines · gene heskett
Greetings all;
Is this kernel vulnerable?
4.19.71-rt24-v7l+ #1 SMP PREEMPT RT Thu Feb 6 07:09:18 EST 2020 armv7l GNU/Linux
No, the vulnerability was introduced in kernel 5.8
Regards,
Arve
Quoted 9 lines · Arve Barsnes
Quoted 6 lines · gene heskett
Greetings all;
Is this kernel vulnerable?
4.19.71-rt24-v7l+ #1 SMP PREEMPT RT Thu Feb 6 07:09:18 EST 2020 armv7l GNU/LinuxNo, the vulnerability was introduced in kernel 5.8
And the latest release is v4.19.233-rt105, while you are still on v4.19.71-rt24. So you are missing out of other security bug fixes for sure. As GregKH would say: All users of the 4.19(-rt) kernel series must upgrade.
A message that is not in the archive (sent off-list or not yet received): 1752976.GyQ78RL1t7@coyote
Quoted 3 lines · gene heskett
For armhf, thats probably best addressed with a quilt command in my present rpi4 working kernel for buster. Is it possible to autogenerate that quilt file?
quilt series are just a file containing one file name per line, so you can generate the quilt series by something like
ls -1 *.patch > quilt-series
The patches you can get via 'git format-patch v4.19.233..v4.19.233-rt105' from the v4.19-rt-rebase branch. Note my instruction might not work out of the box, you need to adapt your local setup.
Quoted 1 line
And what quilt stuff do I need to install on the rpi4?
The compile toolchain, git and quilt?
Quoted 6 lines · Arve Barsnes
Quoted 3 lines · gene heskett
Is this kernel vulnerable?
4.19.71-rt24-v7l+ #1 SMP PREEMPT RT Thu Feb 6 07:09:18 EST 2020 armv7l GNU/LinuxNo, the vulnerability was introduced in kernel 5.8
Hi,
that is my understanding, too, hence my reply yesterday on another mailing list, see
https://lists.ubuntu.com/archives/ubuntu-users/2022-March/307093.html .
However, 4.19 kernels received many patches and I haven't verified myself that non of those patches includes a backport introducing dirty pipe or any other nasty issue.
Regards,
Ralf
Signature · 27 lines
[rocketmouse@archlinux ~]$ pacman -Q linux-rt{-cornflower,-pussytoes,,-securityink}|cut -d\ -f2
4.19.230_rt103-0.300
4.19.227_rt102-0.300
4.19.223_rt100-0.1000
4.19.219_rt97-0.300
[rocketmouse@archlinux ~]$ echo $(uname -srvm;zgrep CONFIG_AUDIT\ /proc/config.gz || zgrep CONFIG_AUDIT= /proc/config.gz);echo;cat /proc/cmdline;echo;grep . /sys/devices/system/cpu/vulnerabilities/* | cut -d/ -f7;rtirq status|head -8
Linux 4.19.230-rt103-0.300-cornflower #1 SMP PREEMPT RT Tue, 22 Feb 2022 07:30:23 +0100 x86_64 # CONFIG_AUDIT is not set
BOOT_IMAGE=../vmlinuz-linux-rt-cornflower root=LABEL=s3.archlinux ro initrd=../intel-ucode.img,../initramfs-linux-rt-cornflower.img
itlb_multihit:KVM: Mitigation: Split huge pages
l1tf:Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT disabled
mds:Mitigation: Clear CPU buffers; SMT disabled
meltdown:Mitigation: PTI
spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl and seccomp
spectre_v1:Mitigation: usercopy
spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling
srbds:Mitigation: Microcode
tsx_async_abort:Not affected
PID CLS RTPRIO NI PRI %CPU STAT COMMAND
142 FF 90 - 130 0.0 S irq/24-xhci_hcd
153 FF 90 - 130 0.0 S irq/16-ehci_hcd
156 FF 89 - 129 0.0 S irq/23-ehci_hcd
312 FF 85 - 125 0.0 S irq/16-snd_hdsp
339 FF 80 - 120 0.0 S irq/16-snd_ice1
42 FF 50 - 90 0.0 S irq/9-acpi