Date: Thu, 28 Sep 2017 17:37:21 -0400 From: Brad Spengler <spender@...ecurity.net> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel CVEs not mentioned on oss-security > > CVE-2017-0605: > > -------------- > > https://security-tracker.debian.org/tracker/CVE-2017-0605 > > upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21] > > > > is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4), > > 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9. > > > > (afaics not Cc'ed to stable). > > Ouch, thanks for letting me know, that's not good, we don't want to get > the trees out of sync for obvious reasons. The above CVE shouldn't exist; the patch doesn't fix any vulnerability as the upstream commit message itself notes, and didn't need to be backported to any of the kernels it was backported to. Not only that, the above advisory marked it as a remote vulnerability with critical severity. It looks like Debian and Ubuntu released updated kernels, while Red Hat and SuSE marked it as WONTFIX and unaffected, respectively. I am not sure why neither simply rejected the CVE. The MSM fix not only is wrong (truncates too early) but seemed to involve a naive strcpy -> strlcpy conversion and assumed it was somehow fixing some exploitable vulnerability (perhaps the cause of the CVE). All methods of setting task->comm ensure nul termination since forever. If nul termination wasn't guaranteed, there would be much bigger problems all over the tree. -Brad Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ