Re: [Security] CVE request: kernel: taskstats/procfs io infoleak (was: taskstats authorized_keys presence infoleak PoC)

[Vasiliy Kulikov <segoon () openwall com>]

On Wed, Jun 29, 2011 at 10:32 -0700, Linus Torvalds wrote:
> On Wed, Jun 29, 2011 at 10:21 AM, Vasiliy Kulikov <segoon () openwall com> wrote:
> > So, with rounded read_characters value it's possible to learn privkey
> > length.
>
> Umm. You can trivially figure that out from the public key lenth
> already, can't you?

No, the attacker here have no information about the key at all.  It
tries to authorize with a random key and a random password.

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments