netdev - Re: [PATCH] r8169: offical fix for CVE-2009-4537 (overlength frame DMAs)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20100329.150924.144366212.davem@davemloft.net>
Date:	Mon, 29 Mar 2010 15:09:24 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	ben@...adent.org.uk
Cc:	nhorman@...driver.com, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, michael.s.gilbert@...il.com,
	davem@...emeloft.net, romieu@...zoreil.com, eric.dumazet@...il.com
Subject: Re: [PATCH] r8169: offical fix for CVE-2009-4537 (overlength frame
 DMAs)

From: Ben Hutchings <ben@...adent.org.uk>
Date: Mon, 29 Mar 2010 23:01:45 +0100

> It also sucks that the secure but low-performance behaviour is enabled
> for all variants, while AIUI only some suffer from the bug.  I realise
> you probably don't have access to every variant (and neither does
> Francois) but perhaps you could come up with a test case that could be
> used to start whitelisting common variants that don't have the bug?

As far as we know all chip variants seem to have the problem.

Furthermore, this issue has been known about and investigated for
about 3 months.  In that time no better options for handling this
issue reliably have been discovered and implemented.

Feel free to code up (and test) something better yourself if you don't
like the fix as it exists currently. :-)

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html