If you're an enlightened sort, who has sought out the sunny uplands of a Linux operating system for your gaming rig in these exciting days of almost seamless game compatibility, then you might want to have a think about migrating your OS onto a beta branch for a while. A list of as-yet unpatched Linux kernel vulnerabilities has been sent out to a public mailing list by accident, and some of these issues score as high as 9 on the CVSS security-scare-o-meter.

The incident was reported by Phoronix yesterday, where Michael Larabel noted that overnight several new vulnerability reports had gone to a public rather than private security mailing list. The reports had seemingly come from Trend Micro's Zero Day Initiative—an initiative set up to promote extended vulnerability reporting (.pdf warning) with a bug bounty system extending to a group of external researchers.

Anyways, the list of vulnerabilities was jumped on by what Phoronix calls Linux's second-in-command, Greg Kroah-Hartman, who maintains the stable branch of the kernel. Kroah-Hartman responded to each of the reports individually asking them to fix their submission process.

Mostly because none of these vulnerabilities have been patched on the main kernel yet, and remain open to attack. And those attack vectors have just been made public. Eep. The more positive news, however, is that some of the cases are undergoing testing or are at least queued in beta or '-next' branches.

So there is a chance that your chosen distro might have those patches in place for the security conscious if you opt-in to a beta branch for an update.

Source link