linux-kernel - Re: wrong order of arguments of ->readdir()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 16 Jul 2007 19:04:20 -0400
From:	Jan Harkes <jaharkes@...cmu.edu>
To:	Al Viro <viro@....linux.org.uk>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: wrong order of arguments of ->readdir()

On Mon, Jul 16, 2007 at 09:49:30PM +0100, Al Viro wrote:
> > c) Jan's patch was not cc'ed to any mailing list
>  
> ... said patch (presumably being an obvious fix of obvious roothole)
> had not been sent to mainline immediately.

The exploiting application would have to run in the role of the
userspace cache manager. In other words, you need to,

  - open /dev/cfs0
  - mount the Coda filesystem and pass the file handle of the opened
    cfs0 device as one of the mount options

Both of these actions already require root, and if you can get this far
without root priviledges it would be considerably easier to just hand a
setuid root shell through the mounted Coda file system.

So I didn't consider this a critical root hole.

> > d) Al's patch was not sent to the maintainer.  Nor to me.  Nor was it
> >    staged in any tree which I can get at so that I could inform people of
> >    the upcoming conflict/duplication/etc.
>  
> Coda is still maintained?  That's certainly news to me - I'm not being
> sarcastic, but my impression had been that coda got abandoned several
> years ago.

Well, in that case someone forgot to update the MAINTAINERS file.

Jan
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/