Received-SPF: pass (google.com: domain of linux-kernel+bounces-86513-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Thu, 29 Feb 2024 11:00:09 +0100
From: Pavel Machek <pavel@ucw.cz>
To: Kees Cook <keescook@chromium.org>
Cc: Michal Hocko <mhocko@suse.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>, cve@kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: CVE-2023-52451: powerpc/pseries/memhp: Fix access beyond end of
 drmem array
Message-ID: <ZeBVqXvK3jFRRwQO@duo.ucw.cz>
References: <2024022257-CVE-2023-52451-7bdb@gregkh>
 <Zdylmz28rZ-mCeiN@tiehlicka>
 <2024022639-wronged-grafted-6777@gregkh>
 <ZdytVTOgfvKBBvtn@tiehlicka>
 <202402271029.FD67395@keescook>
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="iT/0XFoxpI1nuUqC"
Content-Disposition: inline
In-Reply-To: <202402271029.FD67395@keescook>


--iT/0XFoxpI1nuUqC
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi!

> > Does that mean that any potentially incorrect input provided by an admi=
n is
> > considered CVE now?
>=20
> Yes. Have you seen what USER_NS does? There isn't a way to know how
> deployments are using Linux, and this is clearly a "weakness" as defined
> by CVE. It is better to be over zealous than miss things.

Is it?

What is happening now is DoS on anyone who tries to use CVE
database... and on l-k users.

How do I get CVE number for that?

								Pavel
--=20
People of Russia, stop Putin before his war on Ukraine escalates.

--iT/0XFoxpI1nuUqC
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRPfPO7r0eAhk010v0w5/Bqldv68gUCZeBVqQAKCRAw5/Bqldv6
8h+OAKCH++4jPiCiGylouvChUVfpnfx35ACeJ58XFUV/io46sBJajenSW4EpeQI=
=RVwC
-----END PGP SIGNATURE-----

--iT/0XFoxpI1nuUqC--