lkml.org 
[lkml]   [2002]   [Mar]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: zlib vulnerability and modutils
    On Tue, Mar 12, 2002 at 09:56:20AM +1100, you [Keith Owens] wrote:
    > Content-Type: text/plain; charset=us-ascii
    >
    > A double free vulnerability has been found in zlib which can be used in
    > a DoS or possibly in an exploit. Distributions are now shipping
    > upgraded versions of zlib, installing the new version of zlib will fix
    > programs that use the shared library.
    >
    > modutils has an option --enable-zlib which lets modprobe and insmod
    > read modules that have been compressed with gzip. If you built your
    > modutils with --enable-zlib and are using insmod.static then you must
    > rebuild modutils after first upgrading zlib. This only applies if
    > modutils was built with --enable-zlib (the default is not to use zlib)
    > and you also use static versions of modutils.

    I'm propably missing something, but if you load untrusted kernel modules
    (compressed or not), isn't the zlib vulnerability least of your concerns?



    -- v --

    v@iki.fi
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:24    [W:0.027 / U:0.160 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site