perfSONAR User Q&A and Other Discussion

[Andrew Lake <>]

All,

We just wanted to make everyone aware of kernel CVE-2016-5195 since it appears to be making it rounds on the newswire and wanted to make sure people are aware of what it means to your perfSONAR hosts since we often get questions. Details of the CVE from RedHat can be found here: https://access.redhat.com/security/cve/cve-2016-5195

Basically the CVE is about an exploit in the kernel that has likely been around for about 9 years and affects pretty much every Linux distribution out there today. In other words, it is in no-way specific to perfSONAR and affects almost all Linux boxes of any type. The ubiquity is one of the main reasons it is getting attention in the media. It’s a privilege escalation vulnerability meaning someone with a normal Unix account on a system can use it to relatively easily become root. They key here, though, is they first need a regular login on the system to do anything bad. If you are keeping your system patched and following common sense security procedures with regards to passwords/ssh keys, who you give accounts to, etc, getting this regular login should be a non-trivial task for a would-be attacker. 

As for resolution, kernel updates are in various stages of availability from the operating system vendors at this point. It looks like maybe Debian already has a patch out and CentOS is still working on it. Once we have the CentOS kernel we will build the web100 version. Both OS vendors and our team need time to patch and test these things, and we all try to do so in a timely manner, so appreciate your patience. You of course can upgrade to the non-web100 version once CentOS makes their standard version available and forgo NDT in the meantime. Please let us know if you have any questions with regards to perfSONAR and hope you found this helpful. 

Thanks,

The perfSONAR Development Team