Notselwyn/CVE-2024-1086

Windows WSL is affected

joshmcorreia opened this issue · 1 comments

I wasn't sure how or if you'd like to add this to the README, but I noticed it on my own installation and figured it might be important for others.

PS C:\Windows\system32> wsl --version
...
Kernel version: 5.15.146.1-2

The Ubuntu 22.04 WSL installation on Windows is currently affected by this, and standard Windows update methods don't patch it either.

PS C:\Windows\system32> wsl --update
Checking for updates.
The most recent version of Windows Subsystem for Linux is already installed.

It appears that the only way to patch this is to install the pre-release version of WSL (which itself may have bugs, but it's probably better than having a known root exploit)

PS C:\Windows\system32> wsl --update --pre-release

My kernel now reads this after the pre-release install:

Kernel version: 5.15.150.1-2

Interesting! Didn't know if it would work on WSL, thanks for reporting. I believe the kernel itself is included under the affected kernel versions as v5.15.148<=.