linux-kernel - Re: 3.11-final plan: unpriviledged user can crash the kernel (using bluetooth rfcomm)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 1 Sep 2013 13:16:07 -0700
From:	Marcel Holtmann <marcel@...tmann.org>
To:	Pavel Machek <pavel@....cz>
Cc:	Gustavo Padovan <gustavo@...ovan.org>, johan.hedberg@...il.com,
	linux-bluetooth@...r.kernel.org,
	kernel list <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	security@...nel.org
Subject: Re: 3.11-final plan: unpriviledged user can crash the kernel (using bluetooth rfcomm)

Hi Pavel,

>>>>>> . Python sources for client/server are at 
>>>>>> 
>>>>>> http://tui.cvs.sourceforge.net/viewvc/tui/tui/liveview/
>>>>>> 
>>>>>> . My kernels like to warn about
>>>>> System is debian stable with gnome2.
>>>> 
>>>> And no, it is not fixed in 3.11-rc7.
>>> 
>>> 2.6.32-5-686 from debian seems to work.
>> 
>> Could you try linux-next? We recently pushed a rework of the RFCOMM tty
>> handling, it should fix this. The work was too big to be pushed to 3.11
> 
> So... In 3.11 unpriviledged user can crash the kernel, but the fix is
> too big, so we release it without the fix?
> 
> Somehow, I don't think that's good idea.

can you boot a bluetooth-next kernel and see if the planned changes are fixing this or not. I would like to have that confirmed before we start any speculations here.

If the RFCOMM TTY rework that we have in bluetooth-next fixes this issue, then we can have a look at if this can be patched for 3.11 or a stable kernel without having to include the whole patch series. Or if the TTY subsystem changed from 2.6.32 so much that we have to take the whole changes.

However, please also note there is a different between RFCOMM sockets and RFCOMM TTYs. I would be curious if only the TTY part is affected or also the socket part.

Regards

Marcel

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/