Gentoo Archives: gentoo-hardened

From: "Anthony G. Basile" <basile@××××××××××××××.edu>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] hardened-sources wrt CVE-2014-3153 and CVE-2014-0196
Date: Sun, 08 Jun 2014 00:37:58
Message-Id: 5393B0A3.8010007@opensource.dyc.edu
In Reply to: Re: [gentoo-hardened] hardened-sources wrt CVE-2014-3153 and CVE-2014-0196 by "Tóth Attila"
1 On 06/07/14 17:51, "Tóth Attila" wrote:
2 > 2014.Június 7.(Szo) 15:07 időpontban Anthony G. Basile ezt írta:
3 >> This is one of those rare situations where there are enough serious bugs
4 >> against the kernel that we may have to rapid stabilize
5 >> hardened-sources-3.2.59-r5 and 3.14.5-r2. These are currently marked ~
6 >> because I need feedback from users. So please try to upgrade to either
7 >> one (3.2 is preferred for mission critical) and give me feedback. The
8 >> only caution is do not enable KSTACKOVERFLOW, a new option which is know
9 >> to cause panics, eg virtio iface.
10 >
11 > I'm running hardened-sources-3.14.5 since Tuesday, and rebooted into
12 > hardened-sources-3.14.5-r2 on Saturday. I kept KSTACKOVERFLOW enabled for
13 > both kernels and experienced no crashes so far on two systems.
14 >
15 > Dw.
16 >
17
18 You can try KSTACKOVERFLOW. When I hit the issue with virtio iface, it
19 panicked as soon as the init scripts brought it up. When I switched to
20 e1000 it worked fine.
21
22 So if it works with your devices you're probably safe. Still, if you're
23 running some mission critical stuff, don't use it just in case.
24
25 --
26 Anthony G. Basile, Ph. D.
27 Chair of Information Technology
28 D'Youville College
29 Buffalo, NY 14201
30 (716) 829-8197