New Linux Kernel Vulnerability Exploited

[mrugiero]

I use R300g and it doesn't even start. It says something about a missing extension for opengl. I forgot which one it was.

And does it work with Catalyst?
R500 (the newest supported by R300g, if I get their codenames right) supports only OpenGL 2.0 (the hardware, according to wikipedia, not the driver). IIRC, the agreement between Valve and Canonical was to assume OpenGL 2.1 support. R300g is said to support OpenGL2.1, which is weird since the official support of the card is for 2.0.

https://en.wikipedia.org/wiki/Radeon_X1000_Series

http://www.x.org/wiki/RadeonFeature

[mrugiero]

It's a 3400 series from 2008. I didn't know that they will pull the plug on catalyst after x.org 1.11.

Radeon HD 3400? I have a Mobile HD 3200 in my sister's laptop and IIRC mine runs with R600g. Are you sure your setup isn't somehow misdetecting? Anyway, last time I tried Steam there it would start but the display was corrupted. I should try again this afternoon, just out of curiosity.

[Vim_User]

It's a 3400 series from 2008. I didn't know that they will pull the plug on catalyst after x.org 1.11.

This one is based on the RV620 chip and should have no problems with the r600g driver.

[tga.d]

Sure I can see the logic in your reasoning, however we live in a modern age of perpetual internet access where hackers cooperate in teams and communities. The vast majority of exploits are developed in public. More often than not the code is distributed for bragging rights and that is how the exploit is found in the first place. This represents the majority of cases and is the reason why turn around time is so important.

This specific case perfectly disproves that mentality. The exploit code was written in 2010, and was only released after the kernel devs wrote a patch for it. See spender's post for more info:

https://lwn.net/Articles/550683/

[duby229]

Thanks for pointing me to spenders post. He's obviously highly experienced with this specific topic we are discussing. But Really I don't see a difference between his understanding and mine. He obviously has much more experience than me, but our conclusions are similar. What it ultimately comes down to is not about turnaround time, which is still as important as ever but, rather it's about propagation of patches. It's obviously something critical that any IT professional has to deal with. And he is right, the current situation is not good. I agree with him.

EDIT:

An unknown flaw is an unexploited flaw. Therefore the only important factor is time of discovery to time of fix.

This is an earlier post I made in this thread. I believe it accurately reflects the majority of cases. Now after a flaw gets fixed, the trick is to deploy it. Exactly how do you propagate them? Your guess is as good as mine I suppose. I don't have an answer for that.