[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20140827051235.3A34D6C0006@smtpvmsrv1.mitre.org>
Date: Wed, 27 Aug 2014 01:12:35 -0400 (EDT)
From: cve-assign@...re.org
To: meissner@...e.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: Linux Kernel unbound recursion in ISOFS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://code.google.com/p/google-security-research/issues/detail?id=88
> - recurse.iso: crashes / reboots a kernel due to kernel stack overflow / corruption.
Use CVE-2014-5471.
> - deadlock.iso: causes a deadlock in the mount process in "inode_wait"
Use CVE-2014-5472.
> https://github.com/torvalds/linux/commit/410dd3cf4c9b36f27ed4542ee18b1af5e68645a4
> We did not check relocated directory in any way when processing Rock
> Ridge 'CL' tag.
There are the two CVE IDs above, instead of one CVE ID for "did not
check ... in any way."
CVE-2014-5471 is about the need for code to prevent unchecked
recursion (CWE-674), whereas CVE-2014-5472 is not about CWE-674. On
some systems, CVE-2014-5472 might have only a minor security impact by
enabling a user to start an unkillable process (i.e., it would be
minor if there were a low limit on the number of processes the user is
allowed to start).
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJT/WhZAAoJEKllVAevmvmskWYH/2YTlXYpcG5AgNusDLxCEdqs
r+1qOetYYD2VhLr3LqcI0gDAU26V2sNcCej1h4wiVx4q83yN95ZleCYOEEzy99OG
vjQQp/bnhcL1++UJEZvnxvSXbUw8sOcLky60GEHQ6F+MICZcCAUKShtOn0meeQgr
Cke9dXw8pcXFmt7N8R+ztdpot4pxPKUVNmiNNhKC6q9yIQQ+rDVnYD+81+l5vMD3
fpFunsqUclRczEBoh5ptyZ89mNFUytlz1R1gFxN/3fkseFfxybVpBKL3XW364USj
ett5kJxt/jI2yam7rP/eAV166EtjenBNgS6q6boFO8GiyM6OsUYVsYBIUEhuB24=
=R3U4
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
