Fix several vulnerabilities. #30
Conversation
commit 80d172431696482d9acd8d2c4ea78fed8956e2a1 upstream. GCC requires another #include to get the gcc-plugins to build cleanly. Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu> Signed-off-by: Kees Cook <keescook@chromium.org> --- scripts/gcc-plugins/gcc-common.h | 4 ++++ 1 file changed, 4 insertions(+)
More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-1000004 More details here: https://nvd.nist.gov/vuln/detail/CVE-2017-8824 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-1108 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-6412 More details here: https://nvd.nist.gov/vuln/detail/CVE-2017-1000410 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-1092 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-1120 More details here: https://nvd.nist.gov/vuln/detail/CVE-2017-8824 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-10883 More details here: https://nvd.nist.gov/vuln/detail/CVE-2017-5753 More details here: https://nvd.nist.gov/vuln/detail/CVE-2017-5753 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-10877 More details here: https://nvd.nist.gov/vuln/detail/CVE-2011-1161 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-10882 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-1118 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-1093 More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-10881 More details here: https://nvd.nist.gov/vuln/detail/CVE-2017-17741
More details here: https://nvd.nist.gov/vuln/detail/CVE-2018-5390
|
Thanks, HacKurx, for your efforts. But I'm curious if anything might be ready for testing, given that I can't really survey the code, yet (if ever)? I also feel a bit of compunction, for the bad look that all my bugs gave... Nothing wrong, me having reported all the issues that I had --with that one particular system only, of some 3-4 systems that I still use daily or so...-- I'm asking because a signficant fraction of the issues I believe were caused by heat (as minipli claimed --and I'll try and find where and when exactly--), and I found that out when my suspicion that the proc was overheating finally grew large enough to dismantle the entire machine, take out the proc, wipe the cooling paste away with alcohol --nothing showed to be improperly placed, no excess paste to see, no areas not covered with paste-- and to thin-spread it anew on the bottom of the cooler and reassemble the machine. Nothing was wrong with the cooling paste two years and now a few months ago when I installed the then new cooler, but obviously --by conclusion: same paste now --from the same tube--, and cools perfectly!-- gradually it lost the capacity to cool, too gradually for me to notice properly and timely... Maybe up to one half, maybe up to more than one half of the issues that I had there were due to heat... So I thought, if there is anything to test from minipli's repo, to bring back justice to his efforts... Now, let me try and tell exactly when I found out, i.e. when through dismatling and re-spreading --from the same tube-- the cooling paste and reassembling the machine, I figured that out... I need to browse this repo, to tell you... I'm sorry I postponed telling this, I did have other things on my hands... (And while I'd be even less comfortable with all the security holes in the stock kernel, I'm also not very comfortable with no Spectre/Meltdown protection either, in the still-much-less-bugs-in-that-machine-of-mine dappersec kernel... And so I prepare offline the text for posting... Also given that I wasn't able to recompile Pale Moon yet: |
|
I explained in: |
|
Sorry, I tried, but I can find when was it that I promised to report that overheating issue solved... However, it was around one month ago now... |
Force build size overflow hash.
Sorry but you can't expect us to solve your problems because we have more important things to solve. |
|
FWIW - if this is now a LTS type kernel, I'd really like to see @HacKurx patches reviewed by @minipli and pulled in proper. @HacKurx have there been any stability issues with your fork? If not, I may switch over to yours until this is pulled in. |
There shouldn't be any, but it's become less secure than the last kernel upstream. and with this patch: Soon you can compile with : @TerraTech @miroR |
|
@HacKurx wrote:
It's hard to tell. I need to study those links in detail... (time...) Regards! |
|
@HacKurx, who wrote: I thought about it: exec_logging |
It is possible to do this.
Complicated and no one will want to maintain it in the long term. So It is better to consider for replacement with RSBAC (latest version) or SElinux. |
|
First, from the #30 (comment) |
Here is then: 4b7c121 if you want to recover more equivalents: issue-408532627 Best regards, |
Hi @minipli ,
I don't know where you are and if you still intend to continue here.
So I send a commit of despair ^^