lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20140212163825.GE14520@thunk.org> Date: Wed, 12 Feb 2014 11:38:25 -0500 From: Theodore Ts'o <tytso@....edu> To: Eryu Guan <guaneryu@...il.com> Cc: linux-ext4@...r.kernel.org Subject: Re: [PATCH] ext4: don't remove reserved inodes in ext4_unlink() On Sat, Jan 25, 2014 at 02:58:17PM +0800, Eryu Guan wrote: > Corrupted ext4_dir_entry_2 struct on disk may have wrong inode number, > when the inode number is 8 (EXT4_JOURNAL_INO) and the file is deleted, > the journal inode is gone, and unmounting such a fs could trigger the > following BUG_ON() in start_this_handle()..... This patch is mostly good, but you need to exempt the root inode. Otherwise, the following program, which would normally give the error "unlink: Is a directory", will mark the file system as containing an error, and so it could allow an unprivileged user to remount the file system read-only, or force the system to panic and reboot. #include <unistd.h> int main(int argc, char **argv) { if (unlink("/") < 0) perror("unlink"); return 0; } Cheers, - Ted -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists