| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070920210221.GC10625@parisc-linux.org> Date: Thu, 20 Sep 2007 15:02:22 -0600 From: Matthew Wilcox <matthew@....cx> To: linux-kernel@...r.kernel.org Cc: Alan Cox <alan@...rguk.ukuu.org.uk>, linux-serial@...r.kernel.org Subject: Don't cross the (tty) streams Connect two machines with a serial cable. On the victim: willy@...lf:~$ cat </dev/ttyS1 Now, let's find out which ttyS on the other machine is connected ... willy@...th:~$ echo foo >/dev/ttyS1 -bash: echo: write error: Input/output error Oops, that's not a serial port. No output on rowlf, as expected. OK, carrying on ... willy@...th:~$ echo bar >/dev/ttyS0 And yet on rowlf, we now see: foo bar Looks like there's an error path that doesn't throw away data on -EIO. This bug exists on at least these two kernels (because I tested it in both directions: Linux rowlf 2.6.19-rc6-g70d6673f #1 SMP Thu Nov 16 20:49:15 EST 2006 ia64 GNU/Linux Linux teeth 2.6.23-rc3-g68dba7a9-dirty #209 SMP PREEMPT Thu Sep 20 15:57:42 EDT 2007 i686 GNU/Linux Neither kernel has any modifications to its serial code. -- Intel are signing my paycheques ... these opinions are still mine "Bill, look, we understand that you're interested in selling us this operating system, but compare it to ours. We can't possibly take such a retrograde step." - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists