Ubuntu 19.10's Kernel Ships With A DoS / Arbitrary Code Execution Bug In The IPv6 Code

[noangel]

Just tested it on Debian stable. No crash, ping works. Newer doesn't always mean better. Poor Ubuntu users...

[ssokolow]

Ironically, when my ISP adopted/trialed a carrier-grade NAT for a while, they dropped IPv6 support.

*facepalm*

[Isedonde]

I see why it is recommended to stick with an LTS release nowadays. The 6 month release just don't seem to get the testing needed it would appear.

Honestly, for an average desktop Ubuntu user who upgrades to a new STS release within just a few days after release, I don't think this bug is really that terrible. It's only dangerous when you have an "unprivileged local attacker", so if you can't trust your roommate or family member who also happens to have their own account on your computer, then maybe that's a problem. For every other home user, it doesn't really matter.

Obviously this can be a big risk for multi-user environments where you can't trust your users, so this needs to be fixed soon. But most multi-user environments probably take some time to upgrade to a new release anyway, even if they use the STS releases and don't invest time to keep up to date with current vulnerabilities (and possibly patch them on their own), and won't upgrade to 19.10 literally on the first day.

Edit: Also, I don't think this is related to lack of testing at all. Ubuntu kernel team is very likely very aware of the fact that there is a vulnerability in the shipped kernel, but timelines (kernel freeze etc.) didn't leave room to get it fixed before release. In fact, I've just checked the launchpad bug report and they acknowledged the bug 9 days ago and also fixed it in the version control system 9 days ago, but that was too late to include it in the release. So this is not due to a lack of testing, it was simply not deemed high priority enough to warrant breaking the freeze that was put in place.

[tildearrow]

Just tested it on Debian stable. No crash, ping works. Newer doesn't always mean better. Poor Ubuntu users...

Exactly! Mesa 19.1 was a hangfest for me when using VA-API for encoding, so had to go back to 19.0.

[tildearrow]

*facepalm*

Do not worry. They later stopped the trial and gave us IPv6 back.

[ssokolow]

Do not worry. They later stopped the trial and gave us IPv6 back.

I'm not sure this is the appropriate time for "comically missing the point" humour.

[kylew77]

Honestly, for an average desktop Ubuntu user who upgrades to a new STS release within just a few days after release, I don't think this bug is really that terrible. It's only dangerous when you have an "unprivileged local attacker", so if you can't trust your roommate or family member who also happens to have their own account on your computer, then maybe that's a problem. For every other home user, it doesn't really matter.

Obviously this can be a big risk for multi-user environments where you can't trust your users, so this needs to be fixed soon. But most multi-user environments probably take some time to upgrade to a new release anyway, even if they use the STS releases and don't invest time to keep up to date with current vulnerabilities (and possibly patch them on their own), and won't upgrade to 19.10 literally on the first day.

Edit: Also, I don't think this is related to lack of testing at all. Ubuntu kernel team is very likely very aware of the fact that there is a vulnerability in the shipped kernel, but timelines (kernel freeze etc.) didn't leave room to get it fixed before release. In fact, I've just checked the launchpad bug report and they acknowledged the bug 9 days ago and also fixed it in the version control system 9 days ago, but that was too late to include it in the release. So this is not due to a lack of testing, it was simply not deemed high priority enough to warrant breaking the freeze that was put in place.

I just found it ironic with OpenBSD 6.6 and Ubuntu 19.10 releasing on the same day the magnitude of the differences between blocker bugs for release of the two different Unix like operating systems. That in the former a bug like this would never fly but in Ubuntu it wasn't serious enough to delay the launch of the OS by a week even to fix. I don't think an operating system should be shipped with any known bugs, unknown bugs are inevitable but knowing about a bug like this 9 days prior to launch and not doing anything to fix it just seems like bad project management to this student.

[tildearrow]

I'm not sure this is the appropriate time for "comically missing the point" humour.

Sadly, they put us back under the same stupid NAT and now my services are gone and I don't have IPv6 anymore. *sigh*