Bug 283928

Summary:	stabilize sys-kernel/gentoo-sources-2.6.30-r5
Product:	Gentoo Security	Reporter:	Huemi <gentoobugs>
Component:	Kernel	Assignee:	Gentoo Kernel Bug Wranglers and Kernel Maintainers <kernel>
Status:	RESOLVED FIXED
Severity:	critical	CC:	axiator, brayan, bugzilla, security
Priority:	High
Version:	unspecified
Hardware:	AMD64
OS:	Linux
URL:	http://www.h-online.com/security/Critical-vulnerability-in-the-Linux-kernel-affects-all-versions-since-2001--/news/114004
Whiteboard:
Package list:		Runtime testing required:	---

Description Huemi 2009-09-07 06:13:22 UTC

<gentoo-sources-2.6.30-r5 are vulnerable, but no >=gentoo-sources-2.6.30-r5 is marked as stable for amd64 ...

*gentoo-sources-2.6.30-r5 (14 Aug 2009)

  14 Aug 2009; Mike Pagano <mpagano@gentoo.org>
  +gentoo-sources-2.6.30-r5.ebuild:
  Fix for (CVE-2009-2692), Kernel: NULL pointer dereference due to incorrect
  proto_ops initializations. Fix for Linux Kernel clock_nanosleep() NULL
  Pointer Dereference, SA36200. Security hid dereference before null check
  fix. New patch for fbcondecor.


Reproducible: Always

Actual Results:  
gentoo-sources-2.6.30-r5 and gentoo-sources-2.6.30-r6 aren't stable for amd64

Expected Results:  
gentoo-sources-2.6.30-r5 or gentoo-sources-2.6.30-r6 marked as stable for amd64

Comment 1 Jeremy Olexa (darkside) (RETIRED) archtester

2009-09-09 02:45:47 UTC

Keywords: gentoo-sources-2.6.30-r4: amd64 hppa ppc ppc64 
Keywords: gentoo-sources-2.6.30-r5: 
Keywords: gentoo-sources-2.6.30-r6: alpha arm ia64 sh sparc x86 ~amd64 ~hppa ~ppc ~ppc64

Comment 2 Mike Hammill 2009-09-09 15:02:33 UTC

(In reply to comment #1)
Glad someone pointed out the same problem exists on ppc.  Given the seriousness of this bug, newer unstable kernels have to be used immediately, but it would be nice if they became stable soon. :-)

Comment 3 Kevin Stange 2009-09-14 17:42:24 UTC

This is a serious security issue, especially for anyone running a multi-user system because there is a known method for privilege escalation *in the wild*.  Please stabilize this.

Comment 4 Alex Legler (RETIRED) archtester

2009-09-14 18:21:46 UTC

Read the last paragraph on mitigation:
http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html

And now stop the hysteria. Thanks.

Comment 5 Kevin Stange 2009-09-15 07:34:59 UTC

The security "hysteria" aside, this patch closes the hole, it's stable in x86 and even more exotic distros (but not ppc or amd64), and it's already been released to every other major distribution as a stable update.  Why NOT stabilize it?

And back to the "hysteria," why NOT stabilize it?

Comment 6 Olivier Crete (RETIRED) gentoo-dev

2009-09-16 15:05:54 UTC

Tell us three times how serious it is won't make it happen faster.. anyway, amd64 done

Comment 7 nixnut (RETIRED) gentoo-dev

2009-09-20 19:44:28 UTC

ppc stable

Comment 8 nixnut (RETIRED) gentoo-dev

2009-09-20 19:45:41 UTC

pressed a wrong button, sorry

Comment 9 Brent Baude (RETIRED) gentoo-dev

2009-09-28 15:04:57 UTC

ppc64 done

Comment 10 Mike Pagano gentoo-dev

2009-09-29 00:20:17 UTC

Thanks, arch teams.