linux-kernel - Re: [PATCH] fs/binfmt_misc.c: do not allow offset overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180529222445.GD4441@calabresa>
Date:   Tue, 29 May 2018 19:24:47 -0300
From:   Thadeu Lima de Souza Cascardo <cascardo@...onical.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        Alexander Viro <viro@...iv.linux.org.uk>,
        stable@...r.kernel.org
Subject: Re: [PATCH] fs/binfmt_misc.c: do not allow offset overflow

On Tue, May 29, 2018 at 03:08:54PM -0700, Andrew Morton wrote:
> On Tue, 29 May 2018 10:56:48 -0300 Thadeu Lima de Souza Cascardo <cascardo@...onical.com> wrote:
> 
> > It's possible to overflow the offset to get a negative value, which might
> > crash the system, or possibly leak kernel data.
> 
> I think the missing information here is "when registering a new
> binfmt_misc binary type", yes?
> 

Yes, when registering a new type.

[...]
> > Cc: stable@...r.kernel.org
> 
> Registering a handler is a priveleged operation.  As such, I don't
> think a -stable backport is needed?
> 

Not when we take containers in mind. We might question the permission to mount
a binfmt_misc inside a container, that may already have left open other ways of
exploiting the system. But I would rather see this closed on my stable systems.

Cascardo.