lkml.org 
[lkml]   [2006]   [Feb]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: 8250 serial console fixes -- issue
    On Po 06-02-06 20:55:00, Russell King wrote:
    > On Mon, Feb 06, 2006 at 08:26:55PM +0000, Pavel Machek wrote:
    > > Hi!
    > >
    > > > > The serial console driver has a host of issues
    > > > >
    > > > > [...]
    > > > >
    > > > > - [SECURITY] 'r' should require DCD to be asserted
    > > > > before outputing characters. Otherwise we talk to
    > > > > Hayes modem command mode. This allows a non-root
    > > > > user to re-program the modem and is a major security
    > > > > issue is people configure calling line identification
    > > > > or encryption to restrict use of the serial console.
    > > >
    > > > How is this possible? A normal user can't produce arbitarily formatted
    > > > kernel messages, and if they have access to /dev/ttyS they can do what
    > > > ever they like with the port anyway.
    > >
    > > Maybe not *arbitrary* messages, but any user probably can fake enough
    > > to
    > > confuse modem. Name your process \nATD609123456\n and cause it to eat
    > > all memory, or something like that. OOM killer will print name...
    >
    > As I say, it's a problem which needs fixing elsewhere. What if
    > the process was called:
    >
    > \nSystem Halted\n
    >
    > (which will fit in the kernel's process name.) Or maybe some escape
    > sequence which reprograms your terminal.
    >
    > As I say, this is a problem which needs solving by other means. Maybe
    > flush_old_exec() should be a little more careful about what it copies,
    > changing non-alphanumeric characters to '?' ?

    I'm afraid that auditing kernel to never ever print \n from user will
    be quite a long job. If I get

    Killed process 1234
    System Halted
    due to OOM

    I am going to figure it out no problem, but modems do not have that
    kind of abilities...
    Pavel

    --
    Web maintainer for suspend.sf.net (www.sf.net/projects/suspend) wanted...
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-02-07 10:20    [W:0.029 / U:0.192 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site