Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
Follow-up discussion on four Linux kernel local root vulnerabilities (DirtyAH6, PPPoEject, TUNderflow, DiagSpill) weighs per-module kernel packaging trade-offs.
In a follow-up on oss-security, Roman Fiedler discusses the previously disclosed quartet of Linux kernel local root vulnerabilities nicknamed DirtyAH6, PPPoEject, TUNderflow, and DiagSpill. He suggests splitting the kernel into per-module packages could reduce transferred data and potentially limit exposure, but doubts the benefit given modern network and disk sizes. He also notes that selecting module packages across diverse hardware could make installation cumbersome.
- Reply thread concerns four Linux kernel local root vulnerabilities: DirtyAH6, PPPoEject, TUNderflow, DiagSpill
- Author suggests per-module kernel packaging could shrink installed footprint and data transfer
- Benefits questioned given gigabit networking and large disks
- Package selection across diverse hardware may complicate Linux installation
Posted by Roman Fiedler on Sep 20 Well, splitting the kernel in per module packages may have other advantages, e.g. less data transferred due to using selected small packages only, but I don't know if in age of GBit-networking and huge disks is worth it. Otherwise I would assume, that package selection on diverse hardware might get quite annoying during install: you detect some USB hardware, install some USB controller packages, install them, load the modules, the next run...
This source does not provide full text. Read it at seclists.org.