Date: Tue, 25 Jan 2022 19:10:29 +0100
From: Daniel Kulesz <daniel.ina1@googlemail.com>
To: ~alpine/users@lists.alpinelinux.org
Cc: paul@jonar.com
Subject: Re: Alpine Linux affected by CVE-2022-0185?
Message-Id: <20220125191029.bb2f9d7cffc84139ea842f8e@googlemail.com>
In-Reply-To: <CA+ifMgNCQO_+23TcGFF7H072bQRtQ_0vjKofeb01QpeBrd-DiQ@mail.gmail.com>
References: <CA+ifMgNCQO_+23TcGFF7H072bQRtQ_0vjKofeb01QpeBrd-DiQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Hi Paul,

as you can read in the Linux kernel changelog, the bugfix has been applied in kernel 5.15.16 already:

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.16

 vfs: fs_context: fix up param length parsing in legacy_parse_param
...

You can see the link between this fix and CVE-2022-0185 e.g. on Debian's tracker:

https://security-tracker.debian.org/tracker/CVE-2022-0185

Since Alpine already ships kernel 5.15.16 since 2022-01-21 in its linux-lts package, I would consider this fixed in Alpine (at least for 3.15):

https://pkgs.alpinelinux.org/package/edge/main/x86/linux-lts

Cheers, Daniel


On Tue, 25 Jan 2022 18:43:17 +0100
Paul Bakker <paul@jonar.com> wrote:

> So what about this CVE then?
> 
> Should I create an issue for it in Gitlab?
> 
> If so: in which project specifically?





On Tue, 25 Jan 2022 18:43:17 +0100
Paul Bakker <paul@jonar.com> wrote:

> So what about this CVE then?
> 
> Should I create an issue for it in Gitlab?
> 
> If so: in which project specifically?