Another Linux Kernel vuln with no CVE: “…can lead to a negative value
that will later be passed to access_remote_vm(), which can cause unexpected behavior.” In my culture we call that a buffer overflow
lore.kernel.org/patchwork/patc
10
153
632
Conversation
Replying to
i love scrolling through the commit history for, like, the android binder driver and seeing casual UAF or race condition fixes. and then thinking about how android devices don't get kernel patches backported without a CVE 🥲
2
2
31
Android common kernel and GKIs quickly ship the kernel.org LTS branches. It takes them a few months to ship them for non-GKI kernels.
The bare minimum required by the monthly security bulletins is much narrower but they do reference the LTS kernel releases now.
1
1
It's not yet mandatory to promptly ship the LTS kernel releases in order to declare the latest monthly security update. It's likely going to become mandatory to not have so much delay for future releases. Not yet clear what will be required for devices launched with Android 12.
1
1
The security bulletins are a list of known security issues which are mandatory to fix. It's intended to be very easy to apply the fixes. It's anything but easy to ship kernel.org LTS tags right now. There are a massive number of fixes with frequent regressions now.
1
The other side to the kernel.org LTS branches having drastically more fixes than ever before is that it's increasingly hard to integrate/ship them when there are a lot of out-of-tree drivers, even if those drivers eventually got landed upstream for future branches.
Look at how frequent those LTS tags have become and the insane amount of fixes being shipped. GrapheneOS used to ship all the LTS releases within a couple weeks. It's not realistic anymore due to regressions. GKIs will remove the workload of fixing conflicts, etc. but not that.