linux-kernel - Re: [PATCH] hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2025040801-finalize-headlock-669d@gregkh>
Date: Tue, 8 Apr 2025 10:03:50 +0200
From: Greg KH <gregkh@...uxfoundation.org>
To: Christian Brauner <brauner@...nel.org>, cve@...nel.org
Cc: Cengiz Can <cengiz.can@...onical.com>,
	Attila Szasz <szasza.contact@...il.com>,
	Salvatore Bonaccorso <carnil@...ian.org>,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	lvc-patches@...uxtesting.org, dutyrok@...linux.org,
	syzbot+5f3a973ed3dfb85a6683@...kaller.appspotmail.com,
	stable@...r.kernel.org, Alexander Viro <viro@...iv.linux.org.uk>
Subject: Re: [PATCH] hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key

On Mon, Apr 07, 2025 at 12:59:18PM +0200, Christian Brauner wrote:
> On Sun, Apr 06, 2025 at 07:07:57PM +0300, Cengiz Can wrote:
> > On 24-03-25 11:53:51, Greg KH wrote:
> > > On Mon, Mar 24, 2025 at 09:43:18PM +0300, Cengiz Can wrote:
> > > > In the meantime, can we get this fix applied?
> > > 
> > > Please work with the filesystem maintainers to do so.
> > 
> > Hello Christian, hello Alexander
> > 
> > Can you help us with this?
> > 
> > Thanks in advance!
> 
> Filesystem bugs due to corrupt images are not considered a CVE for any
> filesystem that is only mountable by CAP_SYS_ADMIN in the initial user
> namespace. That includes delegated mounting.

Thank you for the concise summary of this.  We (i.e. the kernel CVE
team) will try to not assign CVEs going forward that can only be
triggered in this way.

> The blogpost is aware that the VFS maintainers don't accept CVEs like
> this. Yet a CVE was still filed against the upstream kernel. IOW,
> someone abused the fact that a distro chose to allow mounting arbitrary
> filesystems including orphaned ones by unprivileged user as an argument
> to gain a kernel CVE.

Yes, Canonical abused their role as a CNA and created this CVE without
going through the proper processes.  kernel.org is now in charge of this
CVE, and:

> Revoke that CVE against the upstream kernel. This is a CVE against a
> distro. There's zero reason for us to hurry with any fix.

I will go reject this now.

Note, there might be some older CVEs that we have accidentally assigned
that can only be triggered by hand-crafted filesystem images.  If anyone
wants to dig through the 5000+ different ones we have, we will be glad
to reject them as well.

thanks,

greg k-h