I'm curious... what is the last kernel-level vulnerability discovered and patched for the current XP kernel? There were plenty of updates in SP2, but I don't recall if any of the recent vulnerabilities were kernel level.

The trick with the closed source development model is that we don't know what little vulns are waiting in the XP kernel. We simply don't have the same level of visibility which would result in groups like the grsecurity and PaX folks proactively finding vulns, reporting them to the vendor, and going for full disclosure. Meanwhile, the fact remains that the Linux kernel does not have a dedicated maintainer in charge of security. That was the thrust of the article. Comparing that to Windows, where a single vendor has end to end responsibility, is unfair at best.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/296/30334#30334