Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
oss-security follow-up on four Linux local root vulnerabilities—DirtyAH6, PPPoEject, TUNderflow, DiagSpill—debates distribution-specific patching challenges.
An oss-security thread discusses four Linux local privilege escalation vulnerabilities dubbed DirtyAH6, PPPoEject, TUNderflow and DiagSpill. This reply from Eli Schwartz addresses distribution patching logistics, noting that Gentoo's package manager does not support split subpackages, making fixes impossible to implement for gentoo-kernel-bin or binary package installs. The discussion underscores that some distributions face practical obstacles shipping patched kernels for these local root flaws.
- Four Linux local root vulnerabilities nicknamed DirtyAH6, PPPoEject, TUNderflow and DiagSpill.
- Reply focuses on packaging challenges rather than the flaws themselves.
- Gentoo's package manager cannot implement split subpackages for gentoo-kernel-bin.
- Binary package users face gaps in receiving fixed kernels.
- Products
- Linux kernelgentoo-kernel-bin
From the original article
Posted by Eli Schwartz on Sep 18 That is exactly what Hanno said to do, so I presume that he thinks it is as simple as that. There are, of course, challenges.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.