oss-sec mailing list archives
Re: Re: CVE Request: Squashfs 4.2 Race Condition
From: Jeremy Stanley <jeremy () openstack org>
Date: Thu, 31 Dec 2015 13:54:55 +0000
On 2015-12-31 06:29:55 +0900 (+0900), Jihyeok Seo wrote: [...]
However, firmware upgrade procedures (remote or local) which uses unsquashfs, on devices such as network routers, could be crashed with an untrusted Squashfs filesystem image and lead to denial of service.
To reasonably consider that an exploit, you first have to ask whether there are easier ways for an untrusted firmware upgrade image to crash devices such as network routers. It seems like if you are willing to load an untrusted firmware onto your router, having a patched Squashfs is the least of your worries? -- Jeremy Stanley
Current thread:
- CVE Request: Squashfs 4.2 Race Condition Jihyeok Seo (Dec 30)
- Re: CVE Request: Squashfs 4.2 Race Condition cve-assign (Dec 30)
- Re: CVE Request: Squashfs 4.2 Race Condition Jihyeok Seo (Dec 30)
- Re: Re: CVE Request: Squashfs 4.2 Race Condition Jeremy Stanley (Dec 31)
- Re: CVE Request: Squashfs 4.2 Race Condition Jihyeok Seo (Dec 30)
- Re: CVE Request: Squashfs 4.2 Race Condition cve-assign (Dec 30)