Subject: Re: [vserver] patch for mmap_min_addr in stable version?
From: Romain Riviere <romain.riviere@gmail.com>
Date: Fri, 6 Nov 2009 18:31:18 +0100

 Fri, 6 Nov 2009 18:31:18 +0100
Hi there,

For what it's worth, I use Harry's IPv6+Grsec patch with 2.2.0.7, and  
the GrSec part is enough to prevent the exploit.

Le 6 nov. 2009 à 16:02, Jean-François Leroux a écrit :

> It's about the security vulnerability about this value set to 0 or
> empty, as stated in CVE-2009-3547.
> Does the fact that mmap min addr was introduced in 2.6.23 mean that
> stable vserver kernel is not vulnerable?

I'm afraid it means the opposite : 2.6.23+ can easily be protected by  
setting this parameter to > 0.
Older kernels do not have that luxury :-/

> Does it means guest virtual
> machines, like Debian guests, aren't either?
> And, since we're at it, is there any potential problem with applying a
> patch for this in a vserver kernel?

There might be offsets to watch out for, but apart form that, I don't  
think there could be ... but that's just me =-)

Cheers,