Update Hardy kernel AKI for local privilege escalation

[Ben Jencks]

Can we get updated Hardy kernel AKIs that fix USN-819-1/CVE-2009-2692? Amazon just released updates to their 2.6.18 kernels [1], but I like using the Hardy 2.6.24 kernel.

[1] http://developer.amazonwebservices.com/connect/thread.jspa?threadID=35410

[Soren Hansen (soren)]

Set the importance to medium. This matches the security team's assessment in bug #413656. Note that Ubuntu by default has a value of 65536 for vm.mmap_min_addr, so the only known attack vectors are through setuid binaries or if someone installed wine or dosemu (which causes vm.mmap_min_addr to be set to 0). I think dosemu and wine are rarities on EC2 :)

[Scott Moser (smoser)]

for this task 'linux (Ubuntu)' this bug will be closed when we get karmic kernel (bug 418130).

[Scott Moser (smoser)]

Marking linux (Ubuntu) task as Fix Released, with karmic kernels on ec2.

[Scott Moser (smoser)]

Chuck put together a linux-xen build of 2.6.24-10. It is available on the ubuntu-on-ec2 ppa for hardy [1] and kernel/ramdisks are available in ec2 now in the ubuntu-kernels-testing-us and
ubuntu-kernels-testing-eu buckets [2]
--
[1] https://launchpad.net/~ubuntu-on-ec2/+archive/ppa?field.series_filter=hardy
[2] http://thecloudmarket.com/search?search_term=ubuntu-hardy+image-2.6.24-10

[Scott Moser (smoser)]

Published hardy kernels have fix and new published amis use this kernels

[Alex Valavanis (valavanisalex)]

Intrepid Ibex reached end-of-life on 30 April 2010 so I am closing the report. The bug has been fixed in newer releases of Ubuntu.