linux-kernel - Re: [PATCH 090/173] USB: serial/kobil_sct, fix potential tty NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110427102903.62b2ae09@lxorguk.ukuu.org.uk>
Date:	Wed, 27 Apr 2011 10:29:03 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Jiri Slaby <jslaby@...e.cz>
Cc:	Willy Tarreau <w@....eu>, linux-kernel@...r.kernel.org,
	stable@...nel.org, stable-review@...nel.org,
	Alan Cox <alan@...ux.intel.com>,
	Greg Kroah-Hartman <gregkh@...e.de>
Subject: Re: [PATCH 090/173] USB: serial/kobil_sct, fix potential tty NULL
 dereference

> >> Ok, but this doesn't fix the bug (the URB should be killed or something
> >> similar in that kernel), it only makes the window smaller.
> >
> > OK I get it now, it requires patch 4a90f09b which is quite not some
> > suitable material for -longterm.
> 
> Yeah and perhaps some other changes (like adding hangup support).
> 
> > Do you think it's better to completely remove this patch than making
> > one think the risk of bug is gone while it is not ? Unless we find
> > something more reliable, I'd rather drop the patch.
> 
> To be honest I don't know what's better :). Maybe I would incline to the 
> drop-it side, but leaving up to you.

I'm not sure why a .27 is still maintained to be honest but the reality
is that the lack of tty refcounting on hangup in old kernels is
exploitable in many cases via vhangup() and other approaches combined
with lack of NULL page protection. In several places NULL tty means
NULL->method() is invoked which on an old kernel where a user process has
mapped user virtual address zero means you just got owned.

This is all well known stuff. SELinux will mitigate fairly effectively on
some vendors systems.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/