New Kernel Exploit (CVE-2016-0728)

[arikalish]

Looks like there's a pretty serious exploit in the Linux kernel:

http://linux.slashdot.org/story/16/01/19/1326212/serious-linux-kernel-vulnerability-patched

http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-...

Requires local access or a malicious app so ReadyNAS units are likely only vulnerable if they've got any add-ons installed. Might be worth trying to slip an update into the next RC.

[kohdee · Accepted solution]

Hi,

We've addressed this in OS 6.4.2.

Coming soon 🙂

[AlexPe]

Arikalish,

Thanks for sending this to us. I've submitted this to our engineering group.

I'm unsure what will be done about it at this point. I will up you via PM once I know more.

Alex

[arikalish]

Alex,

Thanks for the quick response. Kernel updates are never fun. Understandable if it takes a little while to get cleared up.

Best,

Ari

[kohdee]

While this is a pretty bad vulnerability, it'd be pretty hard to exploit from the get-go on ReadyNAS. You'd have to be able to execute the file from the backend. If you're concerned, disable SSH access to your ReadyNAS until we patch it. 

[kohdee · Accepted solution]

Hi,

We've addressed this in OS 6.4.2.

Coming soon 🙂

[walshlink]

NOT SOON ENOUGH!

[ChristineT]

Good afternoon ReadyNAS Community,

Thank you for all who contributed to this thread. Please see the following update.

ReadyNAS OS 6.4.2 now available!

Any additional feedback if the issue is resolved or not is greatly appreciated.

Thank you for choosing NETGEAR!

ChristineT

NETGEAR Community Team

[walshlink]

Installed...working awesome!