linux-kernel - Re: Bug: use-after-free in udf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <3220070E-13A5-4805-A99E-D47F6CB3DFB7@m.fudan.edu.cn>
Date: Tue, 7 Jan 2025 21:14:38 +0800
From: Kun Hu <huk23@...udan.edu.cn>
To: Jan Kara <jack@...e.cz>
Cc: jack@...e.com,
 linux-kernel@...r.kernel.org,
 "jjtan24@...udan.edu.cn" <jjtan24@...udan.edu.cn>
Subject: Re: Bug: use-after-free in udf_statfs in fs/udf/super.c:2415


> 
> So this is about your threat model. Writing to the device while a filesystem
> is mounted there is corrupting its cached state - i.e., it is effectively
> equivalent to corrupting memory. Generally only system administrator can do
> this and hence there is not any security vulnerability because the system
> administrator has better means of compromising the machine.
> 
> That being said there are locked down configurations where even root is not
> expected to be able to get full control of the kernel but then you must
> have this properly configured and disabling CONFIG_BLK_DEV_WRITE_MOUNTED is
> one of the things you should do in such case.
> 
> Honza
> -- 
> Jan Kara <jack@...e.com>
> SUSE Labs, CR


Learning a lot, thanks a lot!

———
thanks,
Kun Hu