linux-kernel - Re: Linux ISO-9660 Rock Ridge bug needs fix

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 19 Oct 2006 22:49:19 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Joerg Schilling <Joerg.Schilling@...us.fraunhofer.de>
Cc:	7eggert@....de, schilling@...us.fraunhofer.de,
	linux-kernel@...r.kernel.org, kronos.it@...il.com,
	ismail@...dus.org.tr
Subject: Re: Linux ISO-9660 Rock Ridge bug needs fix

Ar Iau, 2006-10-19 am 23:39 +0200, ysgrifennodd Joerg Schilling:
> Wrong inode numbes do not open holes, they just create a garbage in garbage out
> behavior, but they will not cause the OS to panic. 

Thats implementation dependant as people who stress OS environments and
do fuzz testing have provided again and again and again - including a
previous Linux over ext3 case. There isn't exactly any hurry - its
evident from the lack of reports that you are the first tool author
whose beta tool even uses this feature.

> The unfixed bugs in the Linux iso-9660 implementation on the other side allow 
> me to create a CD that causes Linux to panic without taking me a long time.

And those should indeed be fixed.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/