Re: [bitfolk] CVE-2009-2692 - local->root Linux kernel explo…

Top Page

Reply to this message
Author: Jocke Selin
Date:  
To: users
Subject: Re: [bitfolk] CVE-2009-2692 - local->root Linux kernel exploit
Andy, everybody,

On 19 Aug 2009, at 13:15, Andy Smith wrote:
> On Wed, Aug 19, 2009 at 12:15:53PM +0100, Jocke Selin wrote:
>> On 15 Aug 2009, at 10:26, Andy Smith wrote:
>>> Don't forget that you need to shut down and boot again from xen
>>> shell in order to get a new kernel; just rebooting uses the same
>>> kernel again.
>>
>> Why is this? I thought that, at least on Ubuntu a 'shutdown -r'
>> picks up
>> the latest kernel?!
>
> On a normal machine with grub, a reboot gets you to the point where
> the BIOS runs grub and grub gets kernel, initrd, etc.
>
> On a Xen domU with pygrub, on domain creation pygrub runs in dom0
> (the host server) to read your filesystem, extract your grub config
> file, parse it to find the kernel, initrd etc., extract *those* to
> a temporary directory and then create a domU with those files.
>
> But on a reboot, Xen never actually destroys the virtual machine, it
> just starts it again. That means it will have the same kernel
> (pygrub is never run), same amount of RAM, most probably the same
> size disk devices as well (I have never tested that bit).


Thanks for explaining! I'm very new to, but intrigued by, VPS'. :)

So, a shutdown -h in terminal and then a power-up in Zen console. Check!

>> Get:13 http://apt-cacher.lon.bitfolk.com hardy-updates/universe
>> linux-
>> image-2.6.24-24-xen 2.6.24-24.59 [18.8MB]
>> 45% [13 linux-image-2.6.24-24-xen 8967518/18.8MB 47%]
>> ----
>>
>> Both of them are stuck around 45% download...
>
> The apt-cacher will proxy a connection to the real Ubuntu mirrors if
> it doesn't have the file locally, so it could be that the mirrors
> are overloaded.


Righto - I didn't realise that it fetches the files "real time" for
the first time. Quite natural now when mentioned.

> Is it still happening?


As of a few seconds ago, yes. Still happening.

My unqualified guess would be that this file has been half-downloaded
by the cacher..?!


> Can you try other mirrors (change the part of the URL that is the
> mirror hostname)?


Such as to http://gb.archive.ubuntu.com/ instead of http://apt-cacher.lon.bitfolk.com
?
I can yes. I am, however, a bit reluctant to mess with live servers.
If it's what it takes to get things going, then naturally I'm up for it.

Cheers,

/Jocke