Messages in this thread | | | Date | Thu, 23 Jun 2011 14:44:21 -0700 | From | Greg KH <> | Subject | Re: [PATCH] kernel: escape non-ASCII and control characters in printk() |
| |
On Thu, Jun 23, 2011 at 02:36:05PM +0100, Matthew Garrett wrote: > On Wed, Jun 22, 2011 at 08:37:42AM -0700, Greg KH wrote: > > On Wed, Jun 22, 2011 at 01:53:41PM +0400, Vasiliy Kulikov wrote: > > > This patch escapes all characters outside of allowed '\n' plus 0x20-0x7E > > > charset passed to printk(). > > > > > > There are numerous printk() instances with user supplied input as "%s" > > > data, and unprivileged user may craft log messages with substrings > > > containing control characters via these printk()s. Control characters > > > might fool root viewing the logs via tty. > > > > There are "numerous" places this could happen? > > USB product identifiers?
That's one, sure, but the ability to overwrite something else that you don't want someone to see based on plugging in a USB device is pretty slim. If I can plug any type of USB device I want into the system, odds are I just owned it anyway...
greg k-h
| |