Re: Linux kernel CVEs not mentioned on oss-security

[Brad Spengler <spender () grsecurity net>]

> > CVE-2017-0605:
> > --------------
> > https://security-tracker.debian.org/tracker/CVE-2017-0605
> > upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21]
> >
> > is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4),
> > 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9.
> >
> > (afaics not Cc'ed to stable).
>
> Ouch, thanks for letting me know, that's not good, we don't want to get
> the trees out of sync for obvious reasons.

The above CVE shouldn't exist; the patch doesn't fix any vulnerability
as the upstream commit message itself notes, and didn't need to be
backported to any of the kernels it was backported to.  Not only that, the
above advisory marked it as a remote vulnerability with critical severity.
It looks like Debian and Ubuntu released updated kernels, while Red Hat and
SuSE marked it as WONTFIX and unaffected, respectively.  I am not sure why
neither simply rejected the CVE.

The MSM fix not only is wrong (truncates too early) but seemed to involve a
naive strcpy -> strlcpy conversion and assumed it was somehow fixing some
exploitable vulnerability (perhaps the cause of the CVE).  All methods of
setting task->comm ensure nul termination since forever.  If nul termination
wasn't guaranteed, there would be much bigger problems all over the tree.

-Brad

Attachment: signature.asc
Description: Digital signature