oss-sec mailing list archives
Re: Linux kernel CVEs not mentioned on oss-security
From: Brad Spengler <spender () grsecurity net>
Date: Thu, 28 Sep 2017 17:37:21 -0400
CVE-2017-0605: -------------- https://security-tracker.debian.org/tracker/CVE-2017-0605 upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21] is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4), 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9. (afaics not Cc'ed to stable).Ouch, thanks for letting me know, that's not good, we don't want to get the trees out of sync for obvious reasons.
The above CVE shouldn't exist; the patch doesn't fix any vulnerability as the upstream commit message itself notes, and didn't need to be backported to any of the kernels it was backported to. Not only that, the above advisory marked it as a remote vulnerability with critical severity. It looks like Debian and Ubuntu released updated kernels, while Red Hat and SuSE marked it as WONTFIX and unaffected, respectively. I am not sure why neither simply rejected the CVE. The MSM fix not only is wrong (truncates too early) but seemed to involve a naive strcpy -> strlcpy conversion and assumed it was somehow fixing some exploitable vulnerability (perhaps the cause of the CVE). All methods of setting task->comm ensure nul termination since forever. If nul termination wasn't guaranteed, there would be much bigger problems all over the tree. -Brad
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Re: Linux kernel CVEs not mentioned on oss-security, (continued)
- Re: Linux kernel CVEs not mentioned on oss-security Nicholas Luedtke (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Muhammed Mustapha Abiola (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Solar Designer (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Solar Designer (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Salvatore Bonaccorso (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Brad Spengler (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Marcus Meissner (Sep 27)