[SOLVED] mempodipper / CVE-2012-0056 / linux local root exploit: how to patch?

[m1boli]

Is there a patch or another way to protect against the mempodipper / CVE-2012-0056 / linux local root exploit?

I can delete gpasswd, but I suspect there are other binaries that can exploit the vulnerability.

The current Fedora 15 root is: 2.6.49-10.3. It is vulnerable.

[leigh123linux]

Originally Posted by m1boli

Is there a patch or another way to protect against the mempodipper / CVE-2012-0056 / linux local root exploit?

I can delete gpasswd, but I suspect there are other binaries that can exploit the vulnerability.

The current Fedora 15 root is: 2.6.49-10.3. It is vulnerable.

Why?, it was patched weeks ago
Didn't you read the kernel changelogs?

https://koji.fedoraproject.org/koji/...buildID=298201

* Wed Jan 18 2012 Josh Boyer <jwboyer@redhat.com> 2.6.41.10-1
- Linux 3.1.10 - /proc/pid/* information leak (rhbz 782686)

* Wed Jan 18 2012 Dennis Gilmore <dennis@ausil.us>
- build perf on armv7hl

* Wed Jan 18 2012 Josh Boyer <jwboyer@redhat.com>
- CVE-2012-0056 proc: clean up and fix /proc/<pid>/mem (rhbz 782681)
- loop: prevent information leak after failed read (rhbz 782687)

[m1boli]

Yes, I saw the Fedora Update Notification, which said it fixed this bug.

It seems the problem is that I had not rebooted yet since downloading this version of the kernel.

Oof. My mistake.