Joko tähän on paikkausta saatavilla???
Madrid, December 27 2005 - iDefense has announced a complete memory
exhaustion vulnerability in versions 2.4 and 2.6 of the Linux kernel,
which could allow denial of service attacks.
The flaw stems from a limitation in the design of the Linux kernel, and
consists of a lack of resource checking during the buffering of data for
transfer over a pair of sockets. An attacker could create a situation
which, depending on the available system resources, can cause a 'kernel
panic' due to memory resource exhaustion.
An attack can be launched by opening up a number of connected file
descriptors or socket pairs and creating the largest possible kernel
buffer for data transfer between the two sockets. By causing the process
to enter a zombie state or closing the file descriptor while keeping a
reference open, the data is kept in the kernel until the transfer can
complete. If done repeatedly, system memory resources can be exhausted
from the kernel.
To fully exploit this vulnerability, an attacker would need local access
to the affected system.
Madrid, December 27 2005 - iDefense has announced a complete memory
exhaustion vulnerability in versions 2.4 and 2.6 of the Linux kernel,
which could allow denial of service attacks.
The flaw stems from a limitation in the design of the Linux kernel, and
consists of a lack of resource checking during the buffering of data for
transfer over a pair of sockets. An attacker could create a situation
which, depending on the available system resources, can cause a 'kernel
panic' due to memory resource exhaustion.
An attack can be launched by opening up a number of connected file
descriptors or socket pairs and creating the largest possible kernel
buffer for data transfer between the two sockets. By causing the process
to enter a zombie state or closing the file descriptor while keeping a
reference open, the data is kept in the kernel until the transfer can
complete. If done repeatedly, system memory resources can be exhausted
from the kernel.
To fully exploit this vulnerability, an attacker would need local access
to the affected system.
Vastaukset 3
Vanhimmat
"Joko tähän on paikkausta saatavilla???
Madrid, December 27 2005 "
Oma järjenkäyttö sallittu. Näitä epämääräisiä ilmoituksia reijistä kernelissä aina aika-ajoin tupsahtelee. Niissä ei liiemmin kerrota tarkempaa infoa.
Perusasia on kuitenkin se, ettei näistä ilmoitella ensimmäisinä julkisesti vaan kernel-kehittäjille, joille tarjotaan aikaa tehdä mahdolliset korjaukset. Näistä kerneliin liittyvistä aiheista pysyt parhaiten ajantasalla liittymällä kernel.orgin postituslistoille.
Viimeaikoina 3-4 viikon sisällä on useisiin jakeluihin tullut tarjolle tietoturvapäivityksenä tuorein jakelun kernel-versio.
"an attacker would need local access to the affected system."
Taitaa siis enemmänkin liittyä palvelinjärjestelmiin, eikä mielestäni siis liity tavalliseen kotikäyttöön.
jees, näkyy olevan minunkin distro ajantasalla, mutta kiitos vinkistä.
olisi nyt ollut edes remote exploit..