linux-kernel - linux-stable-5.10-y CVE-2022-1508 of io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 5 May 2022 22:11:59 +0800
From:   Guo Xuenan <guoxuenan@...wei.com>
To:     <axboe@...nel.dk>, <asml.silence@...il.com>
CC:     <lee.jones@...aro.org>, <linux-kernel@...r.kernel.org>,
        <io-uring@...r.kernel.org>, <guoxuenan@...wei.com>,
        <yi.zhang@...wei.com>, <houtao1@...wei.com>
Subject: linux-stable-5.10-y CVE-2022-1508 of io_uring module

Hi, Pavel & Jens

CVE-2022-1508[1] contains an patch[2] of io_uring. As Jones reported,
it is not enough only apply [2] to stable-5.10. 
Io_uring is very valuable and active module of linux kernel.
I've tried to apply these two patches[3] [4] to my local 5.10 code, I
found my understanding of io_uring is not enough to resolve all conflicts.

Since 5.10 is an important stable branch of linux, we would appreciate
your help in soloving this problem.

[1] https://access.redhat.com/security/cve/cve-2022-1508
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89c2b3b7491
[3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8fb0f47a9d7
[4] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cd65869512a

Best regards
Xuenan