[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <51AF8E14.7040205@redhat.com>
Date: Wed, 05 Jun 2013 13:14:28 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Konrad Rzeszutek Wilk <konrad.wilk@...cle.com>
Subject: Re: xen/blkback: Check device permissions before allowing
OP_DISCARD
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/05/2013 11:46 AM, Konrad Rzeszutek Wilk wrote:
> Hey,
>
> John Haxby and Dan Carpenter recommended I ask for an CVE number
> here.
>
> The bug is that if a system admin provides a disk (which supports
> the discard aka TRIM or SCSI UNMAP) to a guest as read-only - there
> are no checks done. Which means that the OS can destroy the data.
>
> The likehood of somebody using 'ro' disks I think is small - but
> there is probably one person who does it and would be unhappy that
> a guest OS can destroy the underlaying data.
>
> I have a patch (and a test-case) ready (see attached). I think I
> just need an CVE number and need to send the mentioned patch to
> Linus?
>
Please use CVE-2013-2140 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRr44UAAoJEBYNRVNeJnmTYhUQAMndCp3wbt65oG/kPDRPIcgz
tOAzJTw99IIQ/n/n+Wxui5c/Rq/RhShahDgsFKXx/PcBw0oZcBQPAwo3j6XqK8Ea
ocXT2BW/IbBOJLEi/A/4lFQtNBMB4CLC02OVaYjRxUqvnGoWFCVGUIBr4S18jMEA
Aqx3fzbPqvL7W0FGNqdpFGaqO4bvZfMTHep9TM4LDRhkLFEntQIFzZ6wCk1CD+iP
sNRTbbOxDl7Pi5ex+jhSUcaudRUGpXb3hr6An6N9llHDuSkQpE9fVKYR8nRYvsyJ
pBrk1piiWKHmQDV+8pxKl4OKjZUpClAu6HLOQ7THzybLIXCdZMbBxIcDzD0zyjpD
g+CblUAwMX3VhaxNRhOXQF3JzViR9fbv6+Etf0TG/iKLfwOMnXoBkz8bbm+rPc79
cnFSEHmFZqVIpnMYDVXTe2hmHGf7T65ZFNM658EZA+ttchiG+70xPqq2W6/XuiGM
Gvqy8MmO2Ufv6/DnL6WtXsLjQFE0nhZzcyGZg3dIjS8tr7o0iQrRITCPaCjGwlL2
cqXl9rPuJOBiojtdM3klF8Trk8d7jD12nmvqYZN/1YBP/s2d3q/G+rRMotPYGpOt
HnKmS/0eTnw0D8pdZz6JAVbljViNY3wgpr9NnpNt2ooKhuJ0awpAu6tN4BagXVda
OtVZADzDl5AkeGZIC0+v
=Rnva
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
