wait
...linux can pick up wifi?
Linux kernel cured of remote panic-attack bug
Developers of the Linux kernel have patched a bug that allowed attackers to remotely crash a machine by sending it malicious Wi-Fi signals. The flaw in the delBA handling of mac80211 has been fixed in version 2.6.32, the latest stable release of the Linux kernel. Various distributions of the open-source operating system have …
-
Thursday 3rd December 2009 21:58 GMT Anonymous Coward
Embedded linux-based home wifi routers.
Woops. There's about a billion of those out there that aren't ever going to get updated kernels. So, next time there's too much contention on your local loop, crash all your neighbours' wifi routers with a single packet, and enjoy all that untrammeled bandwidth for yourself! Muahahahahahaaaa!
-
Friday 4th December 2009 11:19 GMT Anonymous Coward
Nah....
Almost all of the home routers are running something much older than even the 2008 flaw that was fixed. My own nearly new router is running 2.6.10, for example and I don't think the shiny 802.11n one I had for a while was running anything much newer, if at all.
These router people are incredibly conservative.
It's only the bleeding edge distros (ubuntu, fedora, and the like) with the recent kernels that are going to have this issue ...
-
-
Sunday 6th December 2009 00:49 GMT Anonymous Coward
Wrong.
RTFA. There are *two* bugs. The remotely triggerable kernel panic is a different one from the race condition. From the patch:
>"The first problem is that I moved a BUG_ON before various
checks -- thereby making it possible to hit. As the comment
indicates, the BUG_ON can be removed since the ampdu_action
callback must already exist when the state is != IDLE.
The second problem isn't easily exploitable but there's a
race condition due to unconditionally setting the state to
OPERATIONAL when a delBA frame is received, even when no
aggregation session was ever initiated."
-
-
-
-
Friday 4th December 2009 12:44 GMT Gordon is not a Moron
wintards v lintards
the penguin isn't perfect, neither is any other OS, the big difference is in the "fanbois"
wintards : Know that Bill Gates isn't the second coming. And that and any software\OS coming from a company whose top man's offical title is "Chair Thrower in Chief" is going to have it's problems. So that when something goes awry with Linux, best thing is to keep quiet as the next OS fubar is probably going to be one for them to deal with,or to quote Jerry Lawler "keep your words soft and sweet, as you never know when you'll have to eat them."
lintards : Any error from from Redmond is to ridiculed with the volume turned up to 11, and a demonstration of why big business are "Bad". And error with the penguin, is either to be ignored or is somehow a good thing as it's an open source error.
Just wait for the next Win 7 error (and there will be one), it'll take about 2 minutes for the usual "Micro$haft Windoze iz 4 lusers, da Penguin iz way betterer lol" guff to appear.
-
-
-
Friday 4th December 2009 10:52 GMT A J Stiles
Not really
Device drivers in user space would be even worse!
You have, in theory, at least *some* control over what's running in kernel space ..... If the driver is implemented in kernel space, the necessary sanity checking can be done in kernel space where it's not subject to be subverted by a rogue user space application.
The proper place to put a fence is where as little stuff as possible has to pass through it. Not just where it looks pretty.
-
-
Saturday 5th December 2009 23:17 GMT Jose_X
Open vs closed development
Linux developers (or anyone else) announce the bugs. It helps improve the system faster and get the fix out fast. If you don't get to a bug someone else will. There is lots of peer review.
Microsoft and other vendors keep quiet for as long as possible about old bugs and new bugs just introduced. The bugs take their toll when malware damages your files or privacy AND you find out about it.
When you develop in the open, you are forced to come clean and not cut corners else you get called on it as soon as someone realizes.
Linux development also means most distros have some vulnerability or other at any given point in time, but in each case it's a different set. It's a lot more expensive to target Linux as a platform because there are many variations out there (not to mention that a would-be attacker is competing with a whole lot of people that are also watching).
Attackers with money (or a dirty scheme) can always try to buy off from disgruntled Microsoft developers and contractors for secrets, but you can't really buy off what everyone already knows and is forced to keep as clean as possible.
Linux development frequently gets contributions from enthusiastic people very motivated and learned on the product rather than being limited to getting contributions exclusively from mostly the same group of people, some of whom go to work for the money (put in 40 hours of work) and worry more about keeping their nose out of trouble than about doing the best job possible and creating waves or issues.
Linux allows for a path for experimentation/creativity and great feedback without disrupting conservative users.
Open vs. closed development: contributing on your own terms and knowing you will have many reviewers (frequently friendly reviewers) vs. cutting corners in the dark as necessary in order to meet profit goals.
Microsoft keeps secrets from you about your own computer. Linux does not.
So despite Microsoft's well documented dirty play, huge monopoly levers, track record of destroying competitors, etc, Linux continues to get stronger while Microsoft struggles a little more each day. In fact, Google is healthy because of Linux and open source. Stock markets, the Internet, supercomputer users, and many others shun Windows in favor of speedier and more reliable Linux. The Linux desktop keeps improving despite the risks some companies have taken by upsetting Microsoft in order to open specs to Linux.
And did I mention Linux (in any flavor) is $0 for life?
This topic is closed for new posts.
Biting the hand that feeds IT
