[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAKG8Do4-EQkguy1Q+=khZsnPNXLDn5bueBAgPg+FuDvffLST8A@mail.gmail.com>
Date: Tue, 12 Jul 2016 17:20:57 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-5011: util-linux: Extended partition loop
in MBR partition table leads to DoS
On Mon, Jul 11, 2016 at 5:19 PM, Florian Weimer <fweimer@...hat.com> wrote:
> On 07/11/2016 01:32 PM, Cedric Buissart wrote:
>
> I looked at other projects to see what is being done to prevent this
>> particular loop from happening. Until now, tools I checked are protected
>> either by detecting the loop (i.e.: actively searching for a relative
>> offset of 0 for the next EBR, as done by this util-linux patch; partprobe
>> and fdisk are doing that), or enforcing a limit on the maximum number of
>> partitions for a device (Linux kernel, kpartx & other tools I currently
>> checked)
>>
>
> How does util-linux protect against loops which are non-empty? Does it
> reject negative offsets?
>
Indeed, the the patch wasn't sufficient.
The following has been added, in order to prevent jumping back to a
precedent EBR :
https://github.com/karelzak/util-linux/commit/50d1594c2e6142a3b51d2143c74027480df082e0
>
> Thanks,
> Florian
>
--
Cedric Buissart,
Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
