linux-ext4 - Re: [syzbot] [ext4?] kernel panic: EXT4-fs (device loop0): panic forced after error (3)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Aug 2023 12:11:18 -0400
From:   "Theodore Ts'o" <tytso@....edu>
To:     sandeen@...hat.com
Cc:     syzbot <syzbot+27eece6916b914a49ce7@...kaller.appspotmail.com>,
        adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        llvm@...ts.linux.dev, nathan@...nel.org, ndesaulniers@...gle.com,
        syzkaller-bugs@...glegroups.com, trix@...hat.com
Subject: Re: [syzbot] [ext4?] kernel panic: EXT4-fs (device loop0): panic
 forced after error (3)

On Thu, Aug 17, 2023 at 09:47:48AM -0500, Eric Sandeen wrote:
> 
> Just to play devil's advocate here - (sorry) - I don't see this as any
> different from any other "malicious" filesystem image.
> 
> I've never been a fan of the idea that malicious images are real security
> threats, but whether the parking lot USB stick paniced the box in an
> unexpected way or "on purpose," the result is the same ...
> 
> I wonder if it might make sense to put EXT4_MOUNT_ERRORS_PANIC under a
> sysctl or something, so that admins can enable it only when needed.

Well, if someone is stupid enough to plug in a parking lot USB stick
into their system, they get everything they deserve.  And a forced
panic isn't going to lead a more privilege escalation attack, so I
really don't see a problem if a file system which is marked "panic on
error", well, causes a panic.  It's a good way of (harmlessly)
punishing stupid user tricks.  :-)

The other way of thinking about it is that if your threat model
includes an attacker with physical access to the server with a USB
port, attacks include a cable which has a USB port on one side, and a
120V/240V AC mains plug on the the other.  This will very likely cause
a system shutdown, even if they don't have automount enabled.   :-)

							- Ted