Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753875AbaA0X4x (ORCPT ); Mon, 27 Jan 2014 18:56:53 -0500 Received: from mail-ob0-f182.google.com ([209.85.214.182]:34176 "EHLO mail-ob0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751425AbaA0X4w (ORCPT ); Mon, 27 Jan 2014 18:56:52 -0500 MIME-Version: 1.0 In-Reply-To: <52E6E786.80301@gmail.com> References: <20140127230326.GA877@www.outflux.net> <52E6E786.80301@gmail.com> Date: Mon, 27 Jan 2014 15:56:51 -0800 X-Google-Sender-Auth: nNHrQVo4thuU-kseGLFWDZ9Ves4 Message-ID: Subject: Re: [PATCH] vsprintf: BUG on %n From: Kees Cook To: Ryan Mallon Cc: LKML , Andrew Morton , Jiri Kosina , Joe Perches , Al Viro , Olof Johansson , Stepan Moskovchenko , Daniel Borkmann Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jan 27, 2014 at 3:11 PM, Ryan Mallon wrote: > On 28/01/14 10:03, Kees Cook wrote: >> Now that there has been a full release of the kernel, and all users >> of %n have been dropped, switch to %n use triggering a BUG. Ignoring >> arguments could be used to assist in information leaks if an arbitrary >> format string was under the control of an attacker. > > Not sure I follow the reasoning. %n no longer does anything in the > kernel, so there is no risk if it does manage to find its way into a > printed string. BUG() is for unrecoverable errors, which this clearly isn't. > > Information leaks via injectable strings are still possible if an > attacker can insert %x, %d, etc. %n is more problematic since it allows > for code injection, which is why it got removed. %n is not however, > required to get an infoleak via a format string, so I think the summary > is also a bit misleading. Yeah, I'm a bit uncomfortable with the BUG() too. The issue with %n is that it would produce no output at all to skip arguments. With other things, you have to take up output space, which may be limited. How about just not skipping the argument? Leave the warn_on, etc? -Kees -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/