oss-security - Re: Linux kernel: CVE-2018-14619 kernel: crash (possible privesc) in kernel crypto subsystem.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180828125140.GA14413@kroah.com>
Date: Tue, 28 Aug 2018 14:51:40 +0200
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel: CVE-2018-14619 kernel: crash
 (possible privesc) in kernel crypto subsystem.

On Tue, Aug 28, 2018 at 04:49:14PM +1000, Wade Mealing wrote:
> Gday,
> 
> Syzkaller/syzbot found a use-after-free bug in the cryptographic
> subsystem of the Linux kernel [1], that can be used to panic the
> system and possibly escalate privileges.

Are we seriously now going to be assigning cves to everything that
syzbot finds?  If so, great, this is going to be fun!

If not, why this specific patch?  What makes it specia from the hundreds
of other syzbot finds that have been fixed (and not fixed yet)?  This
seems like an odd choice, given:

> The bug was introduced in commit 72548b093ee3, and has been addressed
> in b32a7dc8aef1882fbf983eb354837488cc9d54dc, a reproducer is available
> on the tail end of  syzbots email to kernel list (
> https://lkml.org/lkml/2017/11/27/866 ).  Most RHEL kernels are not
> affected as they do not have the feature, but it does affect the
> kernel-alt package (the 4.11 based kernel for 64-bit ARM , IBM POWER9
> (little endian ) and IBM z Systems ).

So this was introduced in 4.14 which was released Nov 12, 2017, and
fixed in 4.14.8 which was released on Dec 20, 2017.  A very small
window, don't you think.  And one that happened almost a year ago.

If RHEL is not exposed, why does Red Hat care about this?  Who cares
about it?  Anyone running a 4.14.y kernel has had this fixed for a very
long time ago, and anyone not running a 4.14.y kernel is not affected.

Again, I'm really confused why this was chosen for a CVE here.  Care to
explain it a bit better?  Is it because you have to have a CVE for every
bugfix in the RHEL kernel-alt package (something that I would love to
see happen for various other reasons...)

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.