lkml.org 
[lkml]   [2013]   [Sep]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject3.11-final plan: unpriviledged user can crash the kernel (using bluetooth rfcomm)
Hi!

> > On Sat 2013-08-31 12:14:51, Pavel Machek wrote:
> > > On Sat 2013-08-31 12:09:33, Pavel Machek wrote:
> > > > Hi!
> > > >
> > > > > . Python sources for client/server are at
> > > > >
> > > > > http://tui.cvs.sourceforge.net/viewvc/tui/tui/liveview/
> > > > >
> > > > > . My kernels like to warn about
> > > > System is debian stable with gnome2.
> > >
> > > And no, it is not fixed in 3.11-rc7.
> >
> > 2.6.32-5-686 from debian seems to work.
>
> Could you try linux-next? We recently pushed a rework of the RFCOMM tty
> handling, it should fix this. The work was too big to be pushed to 3.11

So... In 3.11 unpriviledged user can crash the kernel, but the fix is
too big, so we release it without the fix?

Somehow, I don't think that's good idea.

Do you have an idea what is the impact? Is it crash-the-kernel or
execute-arbitrary-code?

What about:

a) marking CONFIG_RFCOMM as dangerous in the help text. I just
checked, help text makes it sound like a good thing.

(joke) b) renaming CONFIG_RFCOMM to CONFIG_LET_USER_CRASH_KERNEL

or better yet:

c) removing CONFIG_RFCOMM option in affected releases? I know
regressions are bad, but...

Multiuser desktops are not too common these days, but all the
Android cellphones are "multiuser"...

Plus note that bug is so easy to trigger that I hit it in first minute
trying to get non-malicious application to run.

[3.10 seems also affected.]
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


\
 
 \ /
  Last update: 2013-09-01 21:21    [W:0.119 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site