I've read in news that there is a new Kernel bug https://security-tracker.debian.org/tracker/CVE-2019-8912 Is it safe to use my PC until it gets fixed ? Can someone use this exploit to steal my paypal account, my money and other accounts ? Is there a way to be safe against this type of exploit ?

  • 3
    You'll have to wait until patch is released and apply the patch, or wait till newer kernel is released with the fix and upgrade. – Sergiy Kolodyazhnyy Feb 23 '19 at 7:29
  • before loading latest kernel, some way to protect youself while browsing: use a strong unique kernel for sensitive (money related) site, do not browse as root, use official repository, etc ... – Archemar Feb 25 '19 at 9:46

Kernels 4.20.12, 4.19.25 and 4.14.103 released today (2019-02-23) all contain the fix for CVE-2019-8912. (commit eb5e6869125f69dd28513f92992d97ec62bb9773 net: crypto set sk to NULL when af_alg_release.) Wait until there are updated kernel packages available for Debian or compile your own kernel. Source: https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.25

If you don't use the crypto API you can of course blacklist the relevant kernel module as a workaround in /etc/modprobe.d/blacklist.conf: blacklist af_alg

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.