linux-kernel - Re: [PATCH v2] kdb: Fix a potential buffer overflow in kdb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAD=FV=Ui9bpzkn1EP9VCWGkk5+Q2E9D7QHxPy=2x9avMuNqARg@mail.gmail.com>
Date:   Mon, 27 Nov 2023 07:25:17 -0800
From:   Doug Anderson <dianders@...omium.org>
To:     Christophe JAILLET <christophe.jaillet@...adoo.fr>
Cc:     Jason Wessel <jason.wessel@...driver.com>,
        Daniel Thompson <daniel.thompson@...aro.org>,
        Martin Hicks <mort@....com>, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org,
        kgdb-bugreport@...ts.sourceforge.net
Subject: Re: [PATCH v2] kdb: Fix a potential buffer overflow in kdb_local()

Hi,

On Sat, Nov 25, 2023 at 4:05 AM Christophe JAILLET
<christophe.jaillet@...adoo.fr> wrote:
>
> When appending "[defcmd]" to 'kdb_prompt_str', the size of the string
> already in the buffer should be taken into account.
>
> An option could be to switch from strncat() to strlcat() which does the
> correct test to avoid such an overflow.
>
> However, this actually looks as dead code, because 'defcmd_in_progress'
> can't be true here.
> See a more detailed explanation at [1].
>
> [1]: https://lore.kernel.org/all/CAD=FV=WSh7wKN7Yp-3wWiDgX4E3isQ8uh0LCzTmd1v9Cg9j+nQ@mail.gmail.com/
>
> Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> ---
> Changes in v2:
>    - Delete the strncat() call   [Doug Anderson]
>
> v1: https://lore.kernel.org/all/0b1790ca91b71e3362a6a4c2863bc5787b4d60c9.1698501284.git.christophe.jaillet@wanadoo.fr/
> ---
>  kernel/debug/kdb/kdb_main.c | 2 --
>  1 file changed, 2 deletions(-)

Reviewed-by: Douglas Anderson <dianders@...omium.org>