linux-kernel - Re: [PATCH v2 1/2] tty: tty_io: update timestamps on all device nodes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <2023061325-alibi-grappling-c764@gregkh>
Date:   Tue, 13 Jun 2023 12:23:41 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Michal Sekletar <msekleta@...hat.com>
Cc:     jirislaby@...nel.org, arozansk@...hat.com,
        linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org,
        shuah@...nel.org
Subject: Re: [PATCH v2 1/2] tty: tty_io: update timestamps on all device nodes

On Thu, Jun 08, 2023 at 07:52:54PM +0200, Michal Sekletar wrote:
> On Thu, Jun 8, 2023 at 1:51 PM Greg KH <gregkh@...uxfoundation.org> wrote:
> 
> > So how are you protecting this from being an information leak like we
> > have had in the past where you could monitor how many characters were
> > being sent to the tty through a proc file?  Seems like now you can just
> > monitor any tty node in the system and get the same information, while
> > today you can only do it for the tty devices you have permissions for,
> > right?
> 
> Hi Greg,
> 
> I am not protecting against it in any way, but proposed changes are only
> about timestamp updates which still happen in at least 8 seconds intervals
> so exact timing of read/writes to tty can't be inferred. Frankly, I may
> have misunderstood something. It would be great if you could mention a bit
> more details about CVE you had in mind.

Ah, I missed that this is in 8 second increments, nevermind then!

thanks,

greg k-h