Ask / Submit
18

avoid setting up anonymous pages into file mapping in kernel CVE-2015-3288 [released]

Tracked by Jolla (In release)

asked 2017-02-10 00:02:57 +0300

this post is marked as community wiki

This post is a wiki. Anyone with karma >75 is welcome to improve it.

updated 2017-04-03 18:16:45 +0300

lpr gravatar image

This vulnerability (CVSS v3 Base Score: 7.8 High) has been fixed in kernel 3.4.111 on March 21st '16 but Jolla1-2.1.0 is still on kernel 3.4.108.20161101 and needs that patch to prevent local apps (from e.g. aptoide or apk_s/rpm_s from the web) from gaining root privileges.

edit 20170327: still not fixed in 2.1.0.10 ea
edit 20170403: still not fixed in 2.1.0.11 ea

edit retag flag offensive reopen delete

The question has been closed for the following reason "released in a software update" by lpr
close date 2017-06-14 18:07:05.622632

Comments

I thought we were on 3.10

kat6 ( 2017-02-10 06:48:00 +0300 )edit

@kat6 no ,

lpr ( 2017-02-10 10:04:37 +0300 )edit

Is there active exploit i can use?

coderus ( 2017-02-10 10:21:01 +0300 )edit
3

@coderus The bad guys will have it, for sure ;) since this entered mitre on 2015/04/10 and was fixed Jul 6, 2015 with kernel 4.1.4 but appeared on web.nvd.nist.gov 10/16/2016 and Google Jan'17 marked critical... quite enough time.

lpr ( 2017-02-10 13:56:13 +0300 )edit

Tell me please what the point of writing edit 20170327: still not fixed in 2.1.0.10 ea edit 20170403: still not fixed in 2.1.0.11 ea in each your question?

coderus ( 2017-04-03 20:08:17 +0300 )edit

1 Answer

Sort by » oldest newest most voted
1

answered 2017-02-10 08:41:20 +0300

ghling gravatar image

kat6 is right, 2.1 uses kernel 3.10, at least on my Aqua Fish / Jolla C:

[nemo@Sailfish ~]$ uname -a
Linux Sailfish 3.10.49+0.0.66 #1 SMP PREEMPT Fri Jan 13 19:20:21 UTC 2017 armv7l armv7l armv7l GNU/Linux
edit flag offensive delete publish link more

Comments

1

jolla1 is on 3.4 and will stay there... most likely jollaC-kernel has this vulnerability, too. @ghling on JollaC you'll need at least 3.10.86 to have this patch included automatically!

lpr ( 2017-02-10 10:02:59 +0300 )edit

Question tools

Follow
3 followers

Stats

Asked: 2017-02-10 00:02:57 +0300

Seen: 445 times

Last updated: Apr 03