linux-hardening - Re: CVE-2024-40938: landlock: Fix d

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2024071617-unscathed-spur-f4e5@gregkh>
Date: Tue, 16 Jul 2024 09:17:47 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Kees Cook <kees@...nel.org>
Cc: Mickaël Salaün <mic@...ikod.net>, cve@...nel.org,
	linux-kernel@...r.kernel.org,
	Günther Noack <gnoack@...gle.com>,
	linux-security-module@...r.kernel.org,
	linux-hardening@...r.kernel.org
Subject: Re: CVE-2024-40938: landlock: Fix d_parent walk

On Mon, Jul 15, 2024 at 01:17:10PM -0700, Kees Cook wrote:
> On Mon, Jul 15, 2024 at 08:04:21PM +0200, Mickaël Salaün wrote:
> > Yes, that's why we use WARN_ON_ONCE() to check cases that should never
> > happen (at the time of writting), but in practice it's useful to check
> > (with fuzzing) that this assertion is true.  However, if a
> > WARN_ON_ONCE() is reached, this doesn't mean that this is a security
> > issue, but just an unexpected case that kernel maintainers should be
> > notified with to fix it.
> 
> I leave CVE determinations to the CNA. :) I think the difficulty here is
> with having no way to trivially see which WARN is security sensitive and
> which isn't, and since WARNs may panic, all WARNs could be a DoS, and
> therefore may be a CVE for some deployment somewhere.

That is exactly correct, and why we must mark any way that userspace can
hit a WARN as needing a CVE.

thanks,

greg k-h