If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification whenever a system update fixes a vulnerability.
The devs haven’t said anything about this one AFAIK, though we can at least look at last year’s AI-found LPEs.
Secureblue mitigated Copy Fail and blocked the xfrm-ESP exploit path for Dirty Frag. You can read more about it here.
Kicksecure did neither, as SUID and unprivileged user namespaces aren’t disabled by default. You also can’t selectively enable user namespaces after disabling it, which worsens security for web browsers and breaks some stuff.
If anybody is interested: distros like Secureblue and Kicksecure (and Kicksecure-based ones like Whonix) reduce attack surface by disabling a bunch of kernel modules, and further harden the kernel via sysctl settings and kernel arguments. Secureblue also sends a notification whenever a system update fixes a vulnerability.
https://secureblue.dev/features
https://www.kicksecure.com/#security
So how many of the 900 are they vulnerable to?
The devs haven’t said anything about this one AFAIK, though we can at least look at last year’s AI-found LPEs.
Secureblue mitigated Copy Fail and blocked the xfrm-ESP exploit path for Dirty Frag. You can read more about it here.
Kicksecure did neither, as SUID and unprivileged user namespaces aren’t disabled by default. You also can’t selectively enable user namespaces after disabling it, which worsens security for web browsers and breaks some stuff.