Messages in this thread | | | Date | Wed, 24 Oct 2012 14:33:02 -0700 | Subject | Re: [RESEND][PATCH] gen_init_cpio: avoid stack overflow when expanding | From | Kees Cook <> |
| |
On Wed, Oct 24, 2012 at 2:02 PM, Andrew Morton <akpm@linux-foundation.org> wrote: > On Wed, 24 Oct 2012 13:57:56 -0700 > Kees Cook <keescook@chromium.org> wrote: > >> Fix possible overflow of the buffer used for expanding environment >> variables when building file list. >> >> $ cat usr/crash.list >> file foo ${BIG}${BIG}${BIG}${BIG}${BIG}${BIG} 0755 0 0 >> $ BIG=$(perl -e 'print "A" x 4096;') ./usr/gen_init_cpio usr/crash.list >> *** buffer overflow detected ***: ./usr/gen_init_cpio terminated >> >> This also replaces the space-indenting with tabs. >> >> Patch based on existing fix extracted from grsecurity. >> >> ... >> >> Cc: stable@vger.kernel.org > > Why did you feel we need to backport this to -stable?
It's an extremely hard to hit security issue, but it's a security fix regardless. I won't cry if it doesn't go to stable, but it seems a trivial fix, so I included it for stable.
-Kees
-- Kees Cook Chrome OS Security
| |