Linux kernel RDS flaw affects Red Hat, Ubuntu, Debian and SUSE

LASER_oneXM

Level 37
Thread author
Verified
Top Poster
Well-known
Forum Veteran
Feb 4, 2016
2,516
15,625
3,578
53
Germany / Poland
If you're not in the habit of keeping up to date with the latest version of the Linux kernel, now might be a good time to think about doing so. Systems based on versions of the kernel older than 5.0.8 suffer from a severe flaw in the implementation of RDS over TCP.

Left unpatched, the flaw could enable an attacker to compromise a system. The National Vulnerability Database entry says: "There is a race condition leading to a use-after-free, related to net namespace cleanup".

Red Hat, Ubuntu, Debian and SUSE are all affected by the flaw, and security advisories have been issued for each Linux distro. It is worth noting that the "attack complexity" is rated as being "high", so while the impact of the security hole could be serious, the changes of a successful attack are relatively slim.
 

You may also like...