oss-security - Re: incomplete fix for CVE-2014-4611: kernel: integer overflow in lz4

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.10.1408220034530.14756@wniryva.cad.erqung.pbz>
Date: Fri, 22 Aug 2014 01:04:26 +0530 (IST)
From: P J P <ppandit@...hat.com>
To: OSS Security List <oss-security@...ts.openwall.com>
cc: security@...nel.org, Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Yann Collet <yann.collet.73@...il.com>
Subject: Re: incomplete fix for CVE-2014-4611: kernel: integer
 overflow in lz4_uncompress 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

   Hello Marcus,

+-- On Tue, 19 Aug 2014, Marcus Meissner wrote --+
| Jan Beulich writes in our bug for CVE-2014-4611:
| 
| https://bugzilla.novell.com/show_bug.cgi?id=883949#c12
| 
| --- Comment #12 from Jan Beulich <jbeulich@...e.com> 2014-08-15 21:42:33 UTC ---
| Except that it has been determined quite some time ago that all three fixes
| having gone in upstream so far don't really fix anything. I posted a patch that
| I think actually addresses the issue (https://lkml.org/lkml/2014/7/4/288), but
| till now no-one cared to comment on it, apply it, or point out what's still
| wrong, despite the ping 3 weeks later (https://lkml.org/lkml/2014/7/25/23).

  Jan's patch above does not seem right. It patches a non-existent function 
'lz4_uncompress_unknownoutputs', and does not apply.

$ git apply --check lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch
error: patch failed: lib/lz4/lz4_decompress.c:89
error: lib/lz4/lz4_decompress.c: patch does not apply
 
| Perhaps the kernel folks want to look at it again if they missed it so far.

  I've referred Jan's comment to Yann Collet(CC'd here). He is the creator of 
LZ4 and has agreed to create a saner patch for the said issue. We'll fix it 
soon.

Thank you.
- --
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJT9knCAAoJEN0TPTL+WwQfHtMQALaHo4eTLxKIiDon/wDoJ3y6
OP3FPoLV8QkqdNOgejHp48lrPKxWLzlikCdtenKKWHTl8mTngTgrrCoMlS7IZZx2
TdhR40GCoQeHG/BEmGiuBSbxilgvxNcmvaYxpwHF6CHQhtR0TxROhVUrkYoigNp0
7BDEKt3wCypy/K5GP3mAdMrbGVSmGXqfviRxEBr3K9eBgYkjoxrhw9UcfUWUzIY4
kzqXwKYICJVW1+z4Zyk89KSx/BI1tA4l/A+94SUJB4GnP/nqz+APr2mzutZGB/BE
79F4YwfiP5E5+cRe+HUzQC1H1+LYdjMiTJov6tlNBhAigMErTWvR5pw5odQuts0S
ivDeWPELOVUQyLjj6rDnBydHnMjOYJtImmLze5Nt+HgL+Buffg/ZaiDHC/TkPstQ
oHO05AAPW8iyoOHwBEVmc2sJPRbndMSwBjq8uNLCv8aPrb+yXxQus8zfHRUVzBMD
aM7oAyryY3f5DjGYxqm4GC9FZGUen4u/TC8dzGpPr7VZ8jViWwmFz0tSf0ivL4p5
tx6cgYGd6pvgBiZTXST0ZOLvyk1OyUYVt/bqb1nj/nxNDdrSE7vYB3l/5pePLgJe
EpXOU13CZbNq7sGL+YcxzOZEJQsMQpgKDcweHxD6NJJYr4ut9GFGD5T42G3+K1IM
kN0wJcUuEyQz5OD/6Hcl
=c+qv
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.