Linux Kernel Advisory

[UCMUserAZ]

Hi 3cx team. I am sure you on top of this, but I am posting as my Security assigned me a ticket related to the below:

https://ssd-disclosure.com/ssd-advisory-linux-kernel-pipapo-set-double-free-lpe/

Linux affected versions: Linux Kernel version 5.6-rc1 to version 6.13-rc3

Appears there is no CVE or official patch by Debian. Just wondering if any of this applies to us and/or if any of the other remedies would be taken by 3cx? I let security know we only install approved patches or remedies from 3cx and would ping you all.

Thanks in advance.

 

[TheodorosG_3CX]

Note that any security update and patch will have to be tested from our side first and will apply automatically to the machine(requires the automatic updates are enabled in the PBX). For the security updates list please also check here.
Although this does not seem to apply we will also check this internally and get back.

 

[UCMUserAZ]

Note that any security update and patch will have to be tested from our side first and will apply automatically to the machine(requires the automatic updates are enabled in the PBX). For the security updates list please also check here.
Although this does not seem to apply we will also check this internally and get back.

Thanks.

 

[UCMUserAZ]

Update. After a lot of research appears the Debian kernel used is mitigated already on 3cx. Wooo! Here is command to see:
cat /boot/config-$(uname -r) | grep CONFIG_INIT_STACK_ALL_ZERO

Comes back with a y; it is enabled.

So all good. Thanks.

 

[KyriacosS_3CX]

@UCMUserAZ ,

Thanks for taking the time to confirm this on the forum!

Best,
KS.

 

[exopartners]

Hello,

I'm posting a message regarding kernel updates in this thread.
Unless I'm mistaken, Linux doesn't automatically reboot after applying updates.
There's no option in the 3CX web interface that can be configured to automatically reboot the machine after an update.
I've noticed that machines that are fully updated thanks to autoupdate run old kernels (with potential CVEs).
It seems to me that the behavior can be adapted by modifying the "/etc/apt/apt.conf.d/50unattended-upgrades" file.

Aside from the unavailability of 3CX services (telephony, etc.) during the machine reboot, do you see any contraindications to modifying unattended file to automate reboots?

Is automating reboots after updates a practice that you do not recommend?

Furthermore, I haven't found any mention of kernelcare on the 3CX side.
Will you be offering kernelcare in the long term?
Do you have any contraindications to using kernelcare on Debian 3CX?



Thanks