[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170928213721.GA5119@grsecurity.net>
Date: Thu, 28 Sep 2017 17:37:21 -0400
From: Brad Spengler <spender@...ecurity.net>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel CVEs not mentioned on oss-security
> > CVE-2017-0605:
> > --------------
> > https://security-tracker.debian.org/tracker/CVE-2017-0605
> > upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21]
> >
> > is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4),
> > 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9.
> >
> > (afaics not Cc'ed to stable).
>
> Ouch, thanks for letting me know, that's not good, we don't want to get
> the trees out of sync for obvious reasons.
The above CVE shouldn't exist; the patch doesn't fix any vulnerability
as the upstream commit message itself notes, and didn't need to be
backported to any of the kernels it was backported to. Not only that, the
above advisory marked it as a remote vulnerability with critical severity.
It looks like Debian and Ubuntu released updated kernels, while Red Hat and
SuSE marked it as WONTFIX and unaffected, respectively. I am not sure why
neither simply rejected the CVE.
The MSM fix not only is wrong (truncates too early) but seemed to involve a
naive strcpy -> strlcpy conversion and assumed it was somehow fixing some
exploitable vulnerability (perhaps the cause of the CVE). All methods of
setting task->comm ensure nul termination since forever. If nul termination
wasn't guaranteed, there would be much bigger problems all over the tree.
-Brad
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
