Info Security: Linux Kernel Root Access Vulnerabilities

[linuxviolin]

http://www.us-cert.gov/current/index.ht ... rabilities (added October 25, 2010 at 10:31 am)

For the first vulnerability you have to/can type in a single command as root in a terminal session to do away with this vulnerability until "your distro of choice" puts out a patched kernel. But for the second vulnerability "patches have not yet been released to address this issue."

[DrHu]

Posiblty the first fix, prevent rds module from loading will be enough, since apart from local users, there willneed to be a remote connection exploit to allow access to the system

• Enabling some gnu c library changes, the seond vulnerability

--also that anyone who has a kernel below 2.30 may be OK, since the first vulnerability became known from kernel 2.30 onwards