Subject: [alpine-devel] CVE-2016-5195: Local privilege escalation exploit in Linux kernel

From: "Kevin M. Gallagher" <[email-masked]>
Date: Thu, 20 Oct 2016 21:53:03 -0700

Details:

http://dirtycow.ninja/
https://lkml.org/lkml/2016/10/19/860

Proof of concept:
https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c

I'm using Alpine Linux for a time-urgent and security-critical project
happening this weekend, and would really like to see this fixed. However,
I'm not familiar with aports or the way you build kernels in Alpine. Is
anyone available to update the kernel in linux-grsec in the 3.4-stable
branch and/or backport the patch, sometime soon?

best,
Kevin

---

From: Timo Teras <[email-masked]>
Date: Fri, 21 Oct 2016 08:30:33 +0300

Hi,

On Thu, 20 Oct 2016 21:53:03 -0700
"Kevin M. Gallagher" <[email-masked]> wrote:

> happening this weekend, and would really like to see this fixed.
> However, I'm not familiar with aports or the way you build kernels in
> Alpine. Is anyone available to update the kernel in linux-grsec in
> the 3.4-stable branch and/or backport the patch, sometime soon?

Depending on CVE extent we sometimes cherry-pick fixes. But this seems
bad enough that they released new upstream kernels with pretty much
nothing else than this fix. So we'll be upgrading to them shortly.

Thanks.
Timo

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 21 Oct 2016 10:38:07 +0200

> branch and/or backport the patch, sometime soon?

Yes. Updated kernels will be available with an hour or two. At least
for edge and v3.4.

-nc

---

---

From: "Kevin M. Gallagher" <[email-masked]>
Date: Fri, 21 Oct 2016 01:50:32 -0700

Great to hear. Thanks a lot, Natanael!

---

From: "Kevin M. Gallagher" <[email-masked]>
Date: Fri, 21 Oct 2016 02:23:40 -0700

I just tried to execute the proof-of-concept on Alpine, and it didn't work
(the file is supposed to be overwritten). No grsec messages logged, but I
figure maybe it's not effective under grsecurity for some reason. Still a
good idea to patch anyway...

On Fri, Oct 21, 2016 at 1:50 AM, Kevin M. Gallagher <
[email-masked]> wrote:

>> However,