Question

Does DigitalOcean have any advice on the urgent Stack Clash vulnerability?

Hi,

I just read about this major security vulnerability across multiple OSs, including Linux (presumably all flavors).

https://arstechnica.com/security/2017/06/12-year-old-security-hole-in-unix-based-oses-isnt-plugged-after-all/

How long before a patch is available via our DigitalOcean distributions?


Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

Thanks for posting these instructions.

For Ubuntu 14.04 you’ll see this:

libc6:
  Installed: 2.19-0ubuntu6.13
  Candidate: 2.19-0ubuntu6.13
 *** 2.19-0ubuntu6.13 0
        500 http://mirrors.digitalocean.com/ubuntu/ trusty-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu/ trusty-security/main amd64 Packages
        100 /var/lib/dpkg/status
     2.19-0ubuntu6 0
        500 http://mirrors.digitalocean.com/ubuntu/ trusty/main amd64 Packages

Two CVEs were issued for this vulnerability:

Ubuntu and Debian have already rolled out security updates to the libc6 package. The fixed versions are:

Distro Package Version
Ubuntu 17.04 2.24-9ubuntu2.2
Ubuntu 16.10 2.24-3ubuntu2.2
Ubuntu 16.04 2.23-0ubuntu9
Ubuntu 14.04 2.19-0ubuntu6.13
Debian 8 (jessie) 2.19-18+deb8u10
Debian 9 (stretch) 2.24-11+deb9u1

You can check which version of the package is installed and if the fixed version is available by running:

  1. sudo apt-get update
  2. apt-cache policy libc6

The output will look like:

libc6:
  Installed: 2.24-11
  Candidate: 2.24-11+deb9u1
  Version table:
     2.24-11+deb9u1 500
        500 http://security.debian.org stretch/updates/main amd64 Packages
 *** 2.24-11 500
        500 http://mirrors.digitalocean.com/debian stretch/main amd64 Packages
        100 /var/lib/dpkg/status

This shows me that I have the vulnerable version (2.24-11) installed, but can install the fixed version (2.24-11+deb9u1) by running an upgrade.