Date: Mon, 30 May 2005 07:07:46 +0200
From: Willy Tarreau <willy@w.ods.org>
To: linux-kernel@vger.kernel.org
Cc: julien@cr0.org
Subject: Re: Linux-2.4.30-hf3
Message-ID: <20050530050746.GK18600@alpha.home.local>
References: <20050529223739.GA27341@exosec.fr>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20050529223739.GA27341@exosec.fr>
User-Agent: Mutt/1.4i
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1240
Lines: 34

Hi again,

Julien corrected me on the points below :

>   - a NULL dereference in serial.c found by Julien Tinnes which could lead
>     to an oops.

Could possibly be exploited by mapping the first page of a program and
watching the kernel eat the data instead of oopsing.

>   - an off-by-one in mtrr.c found by Brad Spengler and reported by J.Tinnes
>     which could lead to a panic.

This is inexact. I've checked several other archs :
 - sparc, sparc64, x86_64, alpha, mips all assume that (n) is unsigned and
   will overflow, possibly executing user-controlled code.
 - ppc and ppc64 explicitly check that (n) is < TASK_SIZE and should be safe.
 - x86 will BUG_ON((long)n < 0) (=> oops/panic).
 - others not checked.

>   - a few unchecked strcpy() in ipvs fixed in PaX which I'm not absolutely
>     sure are exploitable, but are definitely dirty and risky.

They are exploitable by anyone with enough privilege to manipulate IPVS.
Think of a user front-end for example.

Thanks,
Willy

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/