sowth's Journal: Could the vmsplice vulnerablility have been prevented?

I was just reading the Linux Kernel Mailing List, and I just saw an interesting message:

... that got me wondering why this attack wasn't stopped by the CONFIG_CC_STACKPROTECTOR option ... some analysis later.. it turns out that the following line in the top level Makefile, added by you in October 2007, entirely disables CONFIG_CC_STACKPROTECTOR ;( With this line removed the exploit will be nicely stopped. ...

-- From: Arjan van de Ven -- Subject: vmsplice exploits, stack protector and Makefiles

The message then shows a line with -fno-stack-protector. Apparently if you remove that flag, your 2.6.x kernel is safe from the exploit.