[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2024071508-prison-liftoff-7987@gregkh>
Date: Mon, 15 Jul 2024 14:39:37 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Mickaël Salaün <mic@...ikod.net>
Cc: cve@...nel.org, linux-kernel@...r.kernel.org,
Günther Noack <gnoack@...gle.com>,
linux-security-module@...r.kernel.org,
linux-hardening@...r.kernel.org
Subject: Re: CVE-2024-40938: landlock: Fix d_parent walk
On Mon, Jul 15, 2024 at 02:20:59PM +0200, Mickaël Salaün wrote:
> On Mon, Jul 15, 2024 at 01:16:38PM +0200, Greg Kroah-Hartman wrote:
> > On Mon, Jul 15, 2024 at 12:37:53PM +0200, Mickaël Salaün wrote:
> > > Hello,
> > >
> > > AFAIK, commit 88da52ccd66e ("landlock: Fix d_parent walk") doesn't fix a
> > > security issue but an unexpected case. The triggered WARN_ON_ONCE() is
> > > just a canary, and this case was correctly handled with defensive
> > > programming and didn't allow to bypass the security policy nor to harm
> > > the kernel. However, this fix should indeed be backported.
> >
> > If a WARN_ON() is hit, a machine with panic_on_warn enabled will reboot,
> > hence if there is any way that userspace can hit this, it needs to be
> > issued a CVE, sorry.
>
> OK, I didn't know about this panic_on_warn rule for CVE. Out of
> curiosity, panic_on_warn is definitely useful for fuzzing and testing,
> but what is the rational to enable panic_on_warn on production systems?
People like to have their devices/servers rebooted if _anything_ is seen
to go wrong. A few billion phones have this enabled, as do most all
cloud servers it seems :(
> It literally transforms a warning message into a system DoS (i.e.
> WARN_ON into BUG_ON).
Yes :(
> We should explicitly use BUG_ON() if this is a critical unhandled
> case, right?
Personally I would use neither, handle the error properly and clean up
correctly. Only if the continuing to run would cause unrecoverable harm
(i.e. data loss or corruption or compromise) would I ever call BUG_ON().
> > > Could you please Cc me for future CVE related to my changes or to
> > > Landlock? For kernel CVEs, I think it would be good to Cc at least
> > > maintainers, reviewers, authors, and committers for the related commits.
> >
> > I suggest setting up lei to watch the linux-cve-announce mailing list if
> > you wish to do this (just filter for landlock stuff). Automatically
> > mailing cve stuff to maintainers has been deemed too "noisy" which is
> > why we do not do this by default.
>
> Well, it might be too noisy for some but I guess/hope not for most.
> Email filtering should be easy for the few receiving too many of these
> emails though.
For now we have decided to not cc: maintainers as these are all sent to
a public list that can be subscribed to if they wish to.
thanks,
greg k-h
Powered by blists - more mailing lists