linux-kernel - Re: [PATCH] pty: fix use after free of tty->driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <56706F6E.2000804@hurleysoftware.com>
Date:	Tue, 15 Dec 2015 11:52:14 -0800
From:	Peter Hurley <peter@...leysoftware.com>
To:	"Herton R. Krzesinski" <herton@...hat.com>
Cc:	linux-kernel@...r.kernel.org,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.com>
Subject: Re: [PATCH] pty: fix use after free of tty->driver_data

On 12/15/2015 11:23 AM, Herton R. Krzesinski wrote:
> On Tue, Dec 15, 2015 at 04:05:09PM -0200, Herton R. Krzesinski wrote:
>> On Tue, Dec 15, 2015 at 09:36:26AM -0800, Peter Hurley wrote:
>>>
>>>
>>>> Signed-off-by: Herton R. Krzesinski <herton@...hat.com>
>>>> Cc: <stable@...r.kernel.org>
>>>
>>> Afaict, the stable tag goes back to the original implementation.
>>> Did you research how far back the /dev/tty alias problem goes?
>>
>> Hmm no. I did cc stable because the first report I got about this issue
>> was on RHEL 7 with 3.10 based kernel, so this issue goes far back
>> some releases that are still supported and similar code is there.
>>
>> On a quick check on a 2.6.32 kernel, things were very different,
>> tty_release_dev() called directly devpts_kill_index with inode
>> from the same file being closed. I'll check more and adjust the tag.
> 
> FYI, checked here and the problem should start with 3.8, after commit
> fa2ecfc5a68d85624bbd84f7d010860776b7e602 devpts_kill_index was moved
> to pty.c/pty_unix98_shutdown
> 

istm this goes back to multi-instance devpts support added in 2.6.28.

Before then, there was no inode parameter because there was only
one devpts instance and the idas were global.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/