[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20161030053557.GA3024@openwall.com>
Date: Sun, 30 Oct 2016 06:35:57 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-5195 test case
Hi Andy,
On Thu, Oct 27, 2016 at 08:35:01AM -0700, Andy Lutomirski wrote:
> I sat on this longer than makes any sense given how easy to reproduce
> CVE-2016-5195 is, but here's a reasonably portable reproducer. It's
> intended to have no side effects, but your mileage may vary.
>
> https://github.com/amluto/vulnerabilities/blob/master/others/CVE-2016-5195/test_CVE-2016-5195.c
>
> This will use /proc/self/mem or ptrace automatically, and it's
> intended to be portable to a wide range of kernels.
Unfortunately, it still didn't work on systems without O_TMPFILE or/and
without a defined PR_SET_PTRACER_ANY.
Attached is a slightly more portable version.
> It's an improved
> version of the test case I originally sent out to distros (oops!).
Why "oops"? Do you mean just the distros vs. linux-distros issue?
It's OK to send reproducers to the [linux-]distros list (the appropriate
one) as long as you intend to make them public shortly after public
disclosure of the issue itself (the earliest of: a few days or when
other public exploits/reproducers show up). I think for most issues,
which are not high impact or/and where non-trivial pre-conditions need
to be met, it makes sense to make the (non-weaponized) reproducers
public right away (on the initial public disclosure date, along with
full vulnerability detail), but occasionally there will be issues like
this where delaying posting the reproducer a little bit makes sense.
It's just that I think you shouldn't have delayed as much. Ideally, you
should have made a posting in here without the reproducer on the initial
public disclosure date (in fact, that's your responsibility per the
[linux-]distros list policy), and as others made reproducers available
within a day, you should have also posted yours the next day.
Just my opinion.
Thank you for your help in handling of this issue!
Alexander
View attachment "test_CVE-2016-5195.c" of type "text/x-c" (5069 bytes)
View attachment "test_CVE-2016-5195.c.diff" of type "text/plain" (740 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
