From: Julian Calaby <julian.calaby@gmail.com>
To: Ben Greear <greearb@candelatech.com>
Cc: "Pali Rohár" <pali@kernel.org>, "Sasha Levin" <sashal@kernel.org>,
"Greg KH" <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
linux-wireless <linux-wireless@vger.kernel.org>
Subject: Re: Drivers for Qualcomm wifi chips (ath*k) and security issues
Date: Tue, 24 Aug 2021 00:54:18 +1000 [thread overview]
Message-ID: <CAGRGNgUMioB8NRrJQjFYRPdEt4OzF50kU6_CJ4nDvqsuq+U6nw@mail.gmail.com> (raw)
In-Reply-To: <18c5a8be-66d7-0dd8-b158-0931335f7ac5@candelatech.com>
Hi Ben,
On Tue, Aug 24, 2021 at 12:37 AM Ben Greear <greearb@candelatech.com> wrote:
>
> On 8/23/21 7:08 AM, Pali Rohár wrote:
> > Hello Sasha and Greg!
> >
> > Last week I sent request for backporting ath9k wifi fixes for security
> > issue CVE-2020-3702 into stable LTS kernels because Qualcomm/maintainers
> > did not it for more months... details are in email:
> > https://lore.kernel.org/stable/20210818084859.vcs4vs3yd6zetmyt@pali/t/#u
>
> For one thing, almost everyone using these radios is using openwrt or
> similar which has its own patch sets.
For reference, according to Debian's own security tracker, only
CVE-2020-26139 is patched on all but the most ancient tracked release:
https://security-tracker.debian.org/tracker/CVE-2020-26139 (fixed in
all but the most ancient release)
https://security-tracker.debian.org/tracker/CVE-2020-3702 (all tracked
kernels are vulnerable)
https://security-tracker.debian.org/tracker/CVE-2020-26145 (only
testing/unstable is fixed)
https://security-tracker.debian.org/tracker/CVE-2020-26141 (only
testing/unstable is fixed)
Debian Buster has a 4.19 kernel and they only released Bullseye, it's
successor, a couple of weeks ago, so there's probably a
not-insignificant number of PCs out there still running kernels that
old, and I understand that they'll be supporting Buster with security
fixes for approximately another year:
https://www.debian.org/security/faq#lifespan
Thanks,
--
Julian Calaby
Email: julian.calaby@gmail.com
Profile: http://www.google.com/profiles/julian.calaby/
next prev parent reply other threads:[~2021-08-23 14:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-23 14:08 Drivers for Qualcomm wifi chips (ath*k) and security issues Pali Rohár
2021-08-23 14:32 ` Ben Greear
2021-08-23 14:54 ` Julian Calaby [this message]
2021-08-23 14:58 ` Pali Rohár
2021-08-23 19:26 ` Sudip Mukherjee
2021-08-23 20:02 ` Pali Rohár
2021-08-23 19:04 ` Greg KH
2021-10-11 10:41 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAGRGNgUMioB8NRrJQjFYRPdEt4OzF50kU6_CJ4nDvqsuq+U6nw@mail.gmail.com \
--to=julian.calaby@gmail.com \
--cc=greearb@candelatech.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-wireless@vger.kernel.org \
--cc=pali@kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).