Fri, 6 Nov 2009 18:31:18 +0100
Hi there,
For what it's worth, I use Harry's IPv6+Grsec patch with 2.2.0.7, and
the GrSec part is enough to prevent the exploit.
Le 6 nov. 2009 à 16:02, Jean-François Leroux a écrit :
> It's about the security vulnerability about this value set to 0 or
> empty, as stated in CVE-2009-3547.
> Does the fact that mmap min addr was introduced in 2.6.23 mean that
> stable vserver kernel is not vulnerable?
I'm afraid it means the opposite : 2.6.23+ can easily be protected by
setting this parameter to > 0.
Older kernels do not have that luxury :-/
> Does it means guest virtual
> machines, like Debian guests, aren't either?
> And, since we're at it, is there any potential problem with applying a
> patch for this in a vserver kernel?
There might be offsets to watch out for, but apart form that, I don't
think there could be ... but that's just me =-)
Cheers,