[lkml]   [2002]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectIs this /dev/sg security hole from 2.2.* already fixed?

I probably should just check myself in recent 2.4.* kernels, but I don't
have one at hand on an SCSI capable machine.

Playing around with generic scsi on my 2.2.18 SCSI based Intel machine, I
noticed that if one reads a large allocated SCSI reply packet from the
/dev/sg device, but the physical scsi device did only use part of the
allocated reply space, then the remaining, unused bytes of the reply
packet are not initialized.

Typically they seem to contain data from other files (some no longer used
diskbuffers or so) [in my case: C-source of the same program].

In case of several accesses to /dev/sg device (same process or same
program run anew on a different /dev/sg device) the remaining bytes
often contained data of previously issued, longer generic scsi

Esp. since AFAIK /dev/sg can be used by non-root users (given write access
to /dev/sg) and other peoples data might pop up in the uninitialized reply
packet, I consider this an (albeit difficult to exploit) security hole.

I assume such a simple problem must have been detected and solved already,
but I can't get a specific answer from any search machine or list archive.

Can someone please comment or try on recent kernels?



Michael Weller:,,
or even If you encounter an eowmob account on
any machine in the net, it's very likely it's me.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:22    [W:0.048 / U:9.076 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site