linux-kernel - Re: [PATCH 090/173] USB: serial/kobil_sct, fix potential tty NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 27 Apr 2011 21:52:53 +0200
From:	Willy Tarreau <w@....eu>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>
Cc:	Jiri Slaby <jslaby@...e.cz>, linux-kernel@...r.kernel.org,
	stable@...nel.org, stable-review@...nel.org,
	Alan Cox <alan@...ux.intel.com>,
	Greg Kroah-Hartman <gregkh@...e.de>
Subject: Re: [PATCH 090/173] USB: serial/kobil_sct, fix potential tty NULL dereference

Hi Alan,

On Wed, Apr 27, 2011 at 10:29:03AM +0100, Alan Cox wrote:
> I'm not sure why a .27 is still maintained to be honest

[OT]

Well, just like 2.4, because there are (a few, but real) users who depend
on it. 2.6.27 was released just 2.5 years ago. There are many places where
servers are deployed to run more than 3 years. With 2.6.32 getting more
reliable nowadays, we could expect to see people deploying it now with
the hope that their servers will still be maintained in 3 years, and we'll
have this discussion again.

[/OT]

> but the reality
> is that the lack of tty refcounting on hangup in old kernels is
> exploitable in many cases via vhangup() and other approaches combined
> with lack of NULL page protection. In several places NULL tty means
> NULL->method() is invoked which on an old kernel where a user process has
> mapped user virtual address zero means you just got owned.

I completely agree with this. This is why I first thought this patch
alone was suitable. However in 2.6.27, DEFAULT_MMAP_MIN_ADDR is set
by default, which substantially reduces the risk.

> This is all well known stuff. SELinux will mitigate fairly effectively on
> some vendors systems.
> 
> Alan

Regards,
Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/