On Fri, Nov 06, 2009 at 04:02:28PM +0100, Jean-François Leroux wrote: > It's about the security vulnerability about this value set > to 0 or empty, as stated in CVE-2009-3547. > Does the fact that mmap_min_addr was introduced in 2.6.23 > mean that stable vserver kernel is not vulnerable? no, but now we arrived at the actual question/issue :) > Does it means guest virtual machines, like Debian guests, > aren't either? there are no virtual machines in Linux-VServer, we use isolation, and the isolated entities are called Guests (JFYI) > And, since we're at it, is there any potential problem with > applying a patch for this in a vserver kernel? no, patching Linux-VServer patched kernels with other patches is usually fine, as long as they do not patch the same code, in this particular case, you want the following commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=patch;h=ad3960243e55320d74195fb85c975e0a8cc4466c which applies with a small offset: patching file fs/pipe.c Hunk #1 succeeded at 684 (offset -93 lines). and IMHO should be fine > Thanks for any info you may have about this, Herbert :) you're welcome, best, Herbert > Jean-François > 2009/11/6 Herbert Poetzl <herbert@13thfloor.at>: > > On Fri, Nov 06, 2009 at 02:24:12AM +0100, Jean-François Leroux wrote: > >> Do we need a patch for this in 2.2.0.7 ? > > probably, but the question is, what do you need the > > mmap_min_addr for? > >> I'm running gentoo (2.6.22vs2.2.0.7.) > >> cat /proc/sys/vm/mmap_min_addr gives me nothing, file missing... > > not unexpected, mmap_min_addr was introduced in 2.6.23 > > best, > > Herbert > >> Cheers