linux-kernel - Re: Linux ISO-9660 Rock Ridge bug needs fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 19 Oct 2006 23:16:30 +0200 (CEST)
From:	Bodo Eggert <7eggert@....de>
To:	Joerg Schilling <Joerg.Schilling@...us.fraunhofer.de>
cc:	7eggert@....de, schilling@...us.fraunhofer.de,
	linux-kernel@...r.kernel.org, kronos.it@...il.com,
	ismail@...dus.org.tr
Subject: Re: Linux ISO-9660 Rock Ridge bug needs fix

On Thu, 19 Oct 2006, Joerg Schilling wrote:
> Bodo Eggert <7eggert@....de> wrote:
> > On Wed, 18 Oct 2006, Joerg Schilling wrote:
> > > Bodo Eggert <7eggert@...tempel.de> wrote:

> > > > BTW2, Just to be cautionous: what will happen if somebody forces the same
> > > > inode number on two different entries?
> >
> > [...]
> > > This is something you cannot check.
> >
> > Exactly that's why I'd ignore the on-disk "inode number" and instead use
> > the generated one untill someone comes along with a clever idea to fix
> > the issue or can show that it's mostly hermless.
> 
> I could understand you in case that Linux would do some basic consistency checks
> in the iso-9660 code already.....

ISO9660-over-NFS is no big usecase, linked files on CD aren't common and 
the current code just won't benefit from hardlinks. Therefore I don't see 
a compelling reason to use this feature without first thinking about 
possible attacks.

Even if there are more holes to be plugged, punching even more holes 
doesn't help. Instead, we should hope that someone finds the time to
plug these holes and praise him when he comes.

> Show me another program besides mkisofs that implements inode numbers _and_ does
> it wrong.

My hacked mkisofs, which I'll use to r00t you all and gain world domination.
-- 
"Don't draw fire; it irritates the people around you."
-Your Buddies
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/