dirtycow/dirtycow.github.io

"Am I affected by the bug?" is misleading

glasser opened this issue · 3 comments

glasser commented

I went to this site on my Mac and saw:

Am I affected by the bug?
Nope.

When I read that, I interpreted this as meaning: This may be a security hole, but it's not a huge deal; we're just making a funny page for it for the hell of it. You don't have to worry about any Linux servers you maintain.

I did not interpret it as meaning "The particular web browser you're using to access this page runs on a system that isn't affected by the bug."

I'd suggest being more clear. (Plus, it doesn't actually detect whether you're running a fixed kernel or not, so even if you understand that the text is dynamic, it's not that helpful.)

Physicist1616 commented

Just tested and confirmed @glasser's last parenthetical remark. The "Am I affected by the bug?" section fails to account for systems running the fixed 4.8.4 kernel.
$ uname -a
Linux arch 4.8.4-1-ARCH #1 SMP PREEMPT Sat Oct 22 18:26:57 CEST 2016 x86_64 GNU/Linux

daveloyall commented

I presumed that the page is static. It doesn't look dynamic.

jlu5 commented

@daveloyall That part is actually a JavaScript snippet which looks for "Android" or "Linux" in the user agent: https://github.com/dirtycow/dirtycow.github.io/blob/master/index.html#L64-L65