Re: zlib vulnerability and modutils

[Ville Herva]

On Tue, Mar 12, 2002 at 09:56:20AM +1100, you [Keith Owens] wrote:
> Content-Type: text/plain; charset=us-ascii
> 
> A double free vulnerability has been found in zlib which can be used in
> a DoS or possibly in an exploit.  Distributions are now shipping
> upgraded versions of zlib, installing the new version of zlib will fix
> programs that use the shared library.
> 
> modutils has an option --enable-zlib which lets modprobe and insmod
> read modules that have been compressed with gzip.  If you built your
> modutils with --enable-zlib and are using insmod.static then you must
> rebuild modutils after first upgrading zlib.  This only applies if
> modutils was built with --enable-zlib (the default is not to use zlib)
> and you also use static versions of modutils.

I'm propably missing something, but if you load untrusted kernel modules
(compressed or not), isn't the zlib vulnerability least of your concerns?

-- v --

[e-mail]