linux-kernel - Re: [PATCH] ovl: Fix info leak in ovl_lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJfpegte3dZKjjLx=to+2XSYyXDkAuuAfhBLHJmuxssuYAGYHg@mail.gmail.com>
Date:   Wed, 21 Sep 2016 16:38:55 +0200
From:   Miklos Szeredi <miklos@...redi.hu>
To:     Kees Cook <keescook@...omium.org>
Cc:     Richard Weinberger <richard@....at>,
        "linux-unionfs@...r.kernel.org" <linux-unionfs@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ovl: Fix info leak in ovl_lookup_temp()

On Fri, Sep 16, 2016 at 10:36 PM, Kees Cook <keescook@...omium.org> wrote:
> On Fri, Sep 16, 2016 at 2:45 AM, Richard Weinberger <richard@....at> wrote:
>> The function uses the memory address of a struct dentry as unique id.
>> While the address-based directory entry is only visible to root
>> it is IMHO still worth fixing since the temporary name does not have
>> to be a kernel address. It can be any unique number. Replace it by an
>> atomic integer which is allowed to wrap around.
>>
>> Signed-off-by: Richard Weinberger <richard@....at>

Thanks, applied and pushed to #overlayfs-next.

Thanks,
Miklos