netdev - Re: [PATCH net 1/1] i40e: fix PTP pins verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230426071812.GK27649@unreal>
Date:   Wed, 26 Apr 2023 10:18:12 +0300
From:   Leon Romanovsky <leon@...nel.org>
To:     Tony Nguyen <anthony.l.nguyen@...el.com>
Cc:     davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
        edumazet@...gle.com, netdev@...r.kernel.org,
        Andrii Staikov <andrii.staikov@...el.com>,
        richardcochran@...il.com,
        Sunitha Mekala <sunithax.d.mekala@...el.com>
Subject: Re: [PATCH net 1/1] i40e: fix PTP pins verification

On Tue, Apr 25, 2023 at 10:04:06AM -0700, Tony Nguyen wrote:
> From: Andrii Staikov <andrii.staikov@...el.com>
> 
> Fix PTP pins verification not to contain tainted arguments. As a new PTP
> pins configuration is provided by a user, it may contain tainted
> arguments that are out of bounds for the list of possible values that can
> lead to a potential security threat. Change pin's state name from 'invalid'
> to 'empty' for more clarification.

And why isn't this handled in upper layer which responsible to get
user input?

Thanks