netdev - Re: We found a bug in i40e_debugfs.c for the latest linux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250715165527.GG721198@horms.kernel.org>
Date: Tue, 15 Jul 2025 17:55:27 +0100
From: Simon Horman <horms@...nel.org>
To: Wang Haoran <haoranwangsec@...il.com>
Cc: anthony.l.nguyen@...el.com, przemyslaw.kitszel@...el.com,
	andrew+netdev@...n.ch, davem@...emloft.net, edumazet@...gle.com,
	kuba@...nel.org, pabeni@...hat.com, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: We found a bug in i40e_debugfs.c for the latest linux

On Tue, Jul 15, 2025 at 09:38:11PM +0800, Wang Haoran wrote:
> Hi Simon,
> 
> Thanks for the clarification.
> 
> We’ve observed that i40e_dbg_command_buf is
> initialized with a fixed size of 256 bytes, but we
> didn’t find any assignment statements updating
> its contents elsewhere in the kernel source code.
> 
> We’re unsure whether this buffer could potentially
> be used or modified in other contexts that we
> might have missed.
> 
> If the buffer is indeed isolated and only used
> as currently observed, then the current use of
> snprintf() should be safe.
> 
> We’d appreciate your confirmation on whether
> this buffer could potentially be used beyond its
> current scope.

Thanks,

My reading is that i40e_dbg_command_buf is declared
as static in i40e_debugfs.c. And thus should only
be updated within the scope of code in that file.

I would be happy to stand corrected on this.