Hacker News Reader

Comment by jesprenj | Hacker News Reader

This affects kernels from 5.8 and was fixed in 5.16.11, 5.15.25 and 5.10.102. Exploit code is public and available on the linked page.

View on HN

It's disturbing that despite prior disclosure on distro lists, Ubuntu doesn't have an update available, with public exploits circulating now.

Debian stable (bullseye) is still vulnerable: https://security-tracker.debian.org/tracker/CVE-2022-0847

That page is not up-to-date, fix was released today:

https://lists.debian.org/debian-security-announce/2022/msg00...

It wasn't available via `apt-get update && apt-get dist-upgrade` as of when I drafted that comment, but I confirm that 5.10.92-2 seems to be released now.

Well the fix was released ~30 minutes ago, so that checks out. ;-)

The security-tracker site is now updated as well.

Others, note that the new archive name is 'stable-security'. You might need to update your pins if you upgraded from Buster and you're not seeing the update now. I put in a pull request to add it to the release notes.

< 5.8 not being affected is probably a saving grace for quite a few enterprises as I'd expect that LTS distributions may not have got that version included as yet.

CentOS 7 is already at 5.10 so it should affect lots of production systems

*blinks*

*stares at kernel-3.10.0-1160.59.1.el7*

Is this a smartphone? I'm on 3.18!

Are you by chance using a 3rd party kernel repo such as ElRepo to work around a limitation? Or could someone at your org be compiling a custom kernel?

How about Ubuntu?

The relevant CVE page returns a 500 error: https://github.com/canonical-web-and-design/ubuntu.com/issue...

21.10 appears to be lacking the patch.

The CVE page returns now, with a whole bunch of "needs triage".

https://ubuntu.com/security/CVE-2022-0847

Reply on news.ycombinator.com