Note: "permalinks" may not be as permanent as we would like,
direct links of old sources may well be a few messages off.
On Sat, 10 Dec 2005 15:19:17 +0100 "LLLActive at GMail.com" <lllactive at gmail.com> wrote: > Hi all, > > I managed to get DRBD 0.7.14 made and built on my 2.6.13-15-default (#1 > Tue Sep 13 14:56:15 UTC 2005 x86_64 x86_64 x86_64 GNU/Linux) SUSE 10.0 > Boxed version. It is running, switches primary and secondary with > drbdadm, mounts the primary etc. I'm on to the heartbeat installation > now. The second DRBD installation is due next week. > > Today the update for the 2.6.13-15-default (#1 Tue Sep 13 14:56:15 UTC > 2005 x86_64 x86_64 x86_64 GNU/Linux) was announced and installable via > YOU. > > Question: With newbie uncertainty in mind, will it do something to my > installation that was made and built (including RPM) on my box. If so, > (1) how can I update DRBD for the 'new' Kernel painlessly; > (2) if I test the new kernel as it is delivered with the current build > of my DRBD, and it strikes, how can I revert back to the old kernel? > (not done that yet); > (3) Advise me if it is necessary to update the kernel (for the > 'stability improvements' and security fixes for the x86_64). One thing about kernel updates you should do, is look at the changelog. For example, if you see something about "ext3 filesystem corruption fixed".. and you're using ext3.. it's probably a good idea to update. ;) The same goes for hardware issues. Why upgrade a kernel, if the only fix is to a network card you don't have? However, in terms of security fixes, this really depends upon your box. Do you care if a local user -> root exploit in your current kernel is possible? It depends on what type of exploit it is, if there are any local users on the box, how many and what type of services you run, and how secure your environment is. If your local lan doesn't even have external network access, you only run NFS on those boxes, the privilege escalation issue you see in the kernel changelong, may not be applicable. After all, upgrading a kernel can _lead_ to bugs you do not have yet! The same goes for security issues. > > All help and advice greatly appreciated. > > -- > I posted this message on Thursday already; did it come through ? ... > > :-) > Al > _________________________________________________ > Alemanne > EU > > :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: > Info on the new Kernel update: > > (Alt Version 2.6.13-15.7 for currently installed 2.6.13-15) > > This kernel update for SUSE Linux 10.0 contains fixes for XEN, various > security fixes and bug fixes. CVE-XXXX-XXXX numbers refer to Mitre CVE > IDs (http://cve.mitre.org/). This update includes a more recent snapshot > of the upcoming Xen 3.0. Many bugs have been fixed. Stability for x86_64 > has been improved. Stability has been improved for SMP, and now both > i586 and x86_64 kernels are built with SMP support. This update contains > the following security fixes: - CVE-2005-3783: A check in ptrace(2) > handling that finds out if a process is attaching to itself was > incorrect and could be used by a local attacker to crash the machine. - > CVE-2005-3784: A check in reaping of terminating child processes did not > consider ptrace(2) attached processes and would leave a ptrace reference > dangling. This could lead to a local user being able to crash the > machine. - CVE-2005-3271: A task leak problem when releasing POSIX > timers was fixed. This could lead to local users causing a local denial > of service by exhausting system memory. - CVE-2005-3805: A locking > problem in POSIX timer handling could be used by a local attacker on a > SMP system to deadlock the machine. - CVE-2005-3181: A problem in the > Linux auditing code could lead to a memory leak which finally could > exhaust system memory of a machine. - CVE-2005-2973: An infinite loop in > the IPv6 UDP loopback handling can be easily triggered by a local user > and lead to a denial of service. - CVE-2005-3806: A bug in IPv6 > flowlabel handling code could be used by a local attacker to free > non-allocated memory and in turn corrupt kernel memory and likely crash > the machine. - CVE-2005-3807: A memory kernel leak in VFS lease handling > can exhaust the machine memory and so cause a local denial of service. > This is seen in regular Samba use and could also be triggered by local > attackers. - CVE-2005-3055: Unplugging an userspace controlled USB > device with an URB pending in userspace could crash the kernel. This can > be easily triggered by local attacker. - - CVE-2005-3180: Fixed > incorrect padding in orinoco wireless driver, which could expose kernel > data to the air. - CVE-2005-3044: Missing sockfd_put() calls in > routing_ioctl() leaked file handles which in turn could exhaust system > memory. - CVE-2005-3527: A race condition in do_coredump in signal.c > allows local users to cause a denial of service (machine hang) by > triggering a core dump in one thread while another thread has a pending > SIGSTOP. Additionaly the following non security bugs were fixed: - Fix > NFS cache consistency races which could lead to data corruption and > crashes. - A kernel panic when loading the r8169 module without > powermanagment was fixed. - i386: A race condition in the > powermanagement module powernow-k8 was fixed. - Special ELF binaries > without DATA and BSS segments could not be loaded due to too strict > kernel checks. - Various bugs in the ALSA sound system were fixed. - A > problem in IPv6 initialization with IPv6 disabled by policy that could > leave dangling kernel pointers around was fixed. - Added sis 965l > support to the sis5513 ide driver. - Disabled C2/C3 powermanagement > states on all IBM R40e BIOSes. - Fixed machine crash when switching the > io-scheduler away from CFQ. - Call reboot notifiers of power off to > switch off certain machines. - AMD64: Don't use TSC for time keeping on > AMD single socket dual core systems. - Fixed the "treason uncloaked" > kernel messages that were caused by a stale pred_flags variable when the > TCP snd_wnd changes. - USB floppy drive SAMSUNG SFD-321U/EP was detected > 8 times. - CONFIG_ACPI_HOTKEY is not supportable yet according to Intel, > so we disabled it. - Disable ACPI on machines from before 2001 on all > kernels again. - USB: always export interface information for modalias. > - Various iSCSI fixes. - Avoid a potential fs corruption on SMP systems. > - i386: Increased number of CONFIG_SERIAL_8250_NR_UARTS to 8. - Fixed a > data corruption in the MD device driver when the delayed recovery is > interrupted. - ahci: Don't set SActive for non-NCQ commands. This could > have left the LED burning even for inactivity. - ppc: Handle GCC 4 > generated relocations for 32bit memory access in the module loader. - > ppc: Removed a special case for ppc to use MAC from prom if CSR is > corrupt - CIFS: Made cifsd (kernel daemon for the CIFS filesystem) > suspend aware. - Fixed ACPI issues on an ASUS L5D. - IDE: Worked around > powermanagement problems. - Disable AMD TLB flush filter on i386/x86-64 > (might help 3d drivers) - Quiet down capacity reading from IDE CD when > no media inserted. - ACPI: Worked around undefined ZOO* objects on > certain Acer Aspire notebooks. - ACPI: Fixed Oops on pcc_acpi unloading. > - ACPI: Fix hang in ACPI device scan on certain HP nx Laptops. - Fixed a > bug in ACL handling of tmpfs. - Fix time going twice as fast problem on > ATI Xpress chipsets. > > :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: > > _______________________________________________ > drbd-user mailing list > drbd-user at lists.linbit.com > http://lists.linbit.com/mailman/listinfo/drbd-user