Subject: Re: [vserver] patch for mmap_min_addr in stable version?
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Fri, 6 Nov 2009 20:23:35 +0100

On Fri, Nov 06, 2009 at 04:02:28PM +0100, Jean-François Leroux wrote:
> It's about the security vulnerability about this value set 
> to 0 or empty, as stated in CVE-2009-3547.

> Does the fact that mmap_min_addr was introduced in 2.6.23 
> mean that stable vserver kernel is not vulnerable? 

no, but now we arrived at the actual question/issue :)

> Does it means guest virtual machines, like Debian guests, 
> aren't either?

there are no virtual machines in Linux-VServer, we
use isolation, and the isolated entities are called
Guests (JFYI)

> And, since we're at it, is there any potential problem with 
> applying a patch for this in a vserver kernel?

no, patching Linux-VServer patched kernels with other
patches is usually fine, as long as they do not patch
the same code, in this particular case, you want the
following commit:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=patch;h=ad3960243e55320d74195fb85c975e0a8cc4466c

which applies with a small offset:

patching file fs/pipe.c
Hunk #1 succeeded at 684 (offset -93 lines).

and IMHO should be fine

> Thanks for any info you may have about this, Herbert :)

you're welcome,
best,
Herbert

> Jean-François

> 2009/11/6 Herbert Poetzl <herbert@13thfloor.at>:
> > On Fri, Nov 06, 2009 at 02:24:12AM +0100, Jean-François Leroux wrote:
> >> Do we need a patch for this in 2.2.0.7 ?

> > probably, but the question is, what do you need the
> > mmap_min_addr for?

> >> I'm running gentoo (2.6.22vs2.2.0.7.)

> >> cat /proc/sys/vm/mmap_min_addr gives me nothing, file missing...

> > not unexpected, mmap_min_addr was introduced in 2.6.23

> > best,
> > Herbert

> >> Cheers