Re: [vserver] Stack Clash patch for Linux-Vserver kernels

From: Corey Wright <undefined_at_pobox.com>
Date: Mon 17 Jul 2017 - 15:11:24 BST
Message-Id: <20170717091124.9473e117c315b0de21e012a8@pobox.com>

On Mon, 17 Jul 2017 04:15:35 +0200
"sunebeck ." <sunebeck@gmail.com> wrote:

> Hi,
>
> I'm sure many have heard about the Stack Clash vulnerability in the
> Linux kernel.
>
> The only time I compiled a Linux kernel with vserver, right after
> another big vulnerability was found, I used the newest linux-source
> from Debian and applied the same available vserver patch. It worked
> back then, but I didn't do rigorous testing, I have to admit.
>
> They say there's two things a patch needs to do:
>
> * Fix the vulnerability
> * Not interfere with the vserver patch
>
> How would guys you go about getting a Stack Clash proofed vserver kernel?

yeah, i was wondering how long it would take before somebody
(indirectly) asked about the 3.18 merge conflict.

stack clash was addressed in upstream 3.18.58. that upstream version
also introduced a conflict with the linux-vserver
patch-3.18.44-vs2.3.7.5.diff patch in the ipv6 code, specifically this
commit:

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.18.y&id=a360eb6f74b999a7546f2542c0d6483fdbb73461

you can either:

* revert the conflicting upstream commit before applying the
  linux-vserver patch.

* apply my patch which *ignorantly* merges the two (giving preference to
  the linux-vserver code as i don't use ipv6).

* ask somebody (herbert?) to *intelligently* fix-up the vserver patch.

i've attached my patch, for purely informational purposes, and suggest
that if you use it then it might cause the end of the world.

1. obtain 3.18.58 (or later)
2. apply patch-3.18.44-vs2.3.7.5.diff
3. apply attached patch-3.18.44-58-vs2.3.7.5.diff

works for me for my usual tests (ie testme.sh, testfs.sh, start guest,
ssh into guest, update guest, stop guest, and do the same for lxc
containers), but will probably end the world for everybody else. i'm up
to 3.18.61 in production (rolled out this weekend) and everything works
for me, but i don't use ipv6.

corey

--
undefined@pobox.com
> Sune
> 
> P.S: This list rejected my mail several time due to a SORBS listing -
> apparently, SORBS blocked Gmail(!).
i would block gmail, too, just out of principle. ;)

Received on Mon Jul 17 15:11:03 2017
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Mon 17 Jul 2017 - 15:11:03 BST by hypermail 2.1.8