Hacker News new | ask | show | jobs
by tryauuum 19 days ago
whoa, didn't expect a wall of text

When I said about "no mitigations except for the kernel updates" I meant exactly that. Some sysctl config to flip, some kernel module to unload. Apparently such thing doesn't exist in this one

1 comments

> The affected range is v2.6.39-rc1 to v7.1-rc1, with CONFIG_FUTEX_PI=y the only requirement and no capabilities or user namespaces needed.
See also https://nebusec.ai/research/ionstack-part-2/#mitigation for the fullpatch and two other mitigations