linux-cve-announce - Re: CVE-2023-52656: io_uring: drop any code related to SCM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052542-diner-snare-a618@gregkh>
Date: Sat, 25 May 2024 09:15:33 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Jens Axboe <axboe@...nel.dk>
Cc: Gabriel Krisman Bertazi <krisman@...e.de>,
	linux-cve-announce@...r.kernel.org, cve@...nel.org,
	linux-kernel@...r.kernel.org
Subject: Re: CVE-2023-52656: io_uring: drop any code related to SCM_RIGHTS

On Fri, May 24, 2024 at 10:57:07AM -0600, Jens Axboe wrote:
> On 5/24/24 10:45 AM, Gabriel Krisman Bertazi wrote:
> > Greg Kroah-Hartman <gregkh@...uxfoundation.org> writes:
> > 
> >> Description
> >> ===========
> >>
> >> In the Linux kernel, the following vulnerability has been resolved:
> >>
> >> io_uring: drop any code related to SCM_RIGHTS
> >>
> >> This is dead code after we dropped support for passing io_uring fds
> >> over SCM_RIGHTS, get rid of it.
> >>
> >> The Linux kernel CVE team has assigned CVE-2023-52656 to this issue.
> > 
> > Hello Greg,
> > 
> > [+Jens in Cc]
> > 
> > This is stable material, but doesn't deserve CVE status.  There is
> > nothing exploitable that is fixed here. Instead, this commit is dropping
> > unreachable code after the removal of a feature, following another CVE
> > report.  Doing the clean up in the original patch would have made the
> > real security fix harder to review.
> > 
> > The real issue was reported as CVE-2023-52654 and handled by a different
> > commit.
> 
> FWIW, the same is true for a number of other commits recently. They are
> nowhere near CVE material, it's just generic bug fixes.

Ok, glad to revoke them if you do not think they are user triggerable
issues.  I'll go reject this one right now, thanks.

greg k-h