linux-kernel - Re: A Discussion Request about a maybe-false-positive of UBSAN: OOB Write in do_journal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230811043750.GA1934@sol.localdomain>
Date:   Thu, 10 Aug 2023 21:37:50 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Jan Kara <jack@...e.cz>
Cc:     Zhang Zhiyu <zhiyuzhang999@...il.com>,
        reiserfs-devel@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-fsdevel@...r.kernel.org
Subject: Re: A Discussion Request about a maybe-false-positive of UBSAN: OOB
 Write in do_journal_end in Kernel 6.5-rc3(with POC)

On Wed, Aug 09, 2023 at 10:15:23PM -0700, Eric Biggers wrote:
> On Wed, Aug 09, 2023 at 05:32:07PM +0200, Jan Kara wrote:
> > Improving kernel security is certainly a worthy goal but I have two notes.
> > Firstly, reiserfs is a deprecated filesystem and it will be removed from
> > the kernel in a not so distant future. So it is not very useful to fuzz it
> > because there are practically no users anymore and no developer is
> > interested in fixing those bugs even if you find some. Secondly, please do
> > a better job of reading the code and checking whether your theory is
> > actually valid before filing a CVE (CVE-2023-4205). That's just adding
> > pointless job for everyone... Thanks!
> 
> FYI I filled out https://cveform.mitre.org/ to request revocation of this CVE.
> 
> - Eric

Just to follow up on this, the CVE has now been "rejected".  For future
reference, MITRE had me contact Red Hat since they issued the CVE.  So the right
procedure was to email secalert@...hat.com, not fill out the CVE form.

- Eric