lkml.org 
[lkml]   [2012]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [RESEND][PATCH] gen_init_cpio: avoid stack overflow when expanding
    From
    On Wed, Oct 24, 2012 at 2:02 PM, Andrew Morton
    <akpm@linux-foundation.org> wrote:
    > On Wed, 24 Oct 2012 13:57:56 -0700
    > Kees Cook <keescook@chromium.org> wrote:
    >
    >> Fix possible overflow of the buffer used for expanding environment
    >> variables when building file list.
    >>
    >> $ cat usr/crash.list
    >> file foo ${BIG}${BIG}${BIG}${BIG}${BIG}${BIG} 0755 0 0
    >> $ BIG=$(perl -e 'print "A" x 4096;') ./usr/gen_init_cpio usr/crash.list
    >> *** buffer overflow detected ***: ./usr/gen_init_cpio terminated
    >>
    >> This also replaces the space-indenting with tabs.
    >>
    >> Patch based on existing fix extracted from grsecurity.
    >>
    >> ...
    >>
    >> Cc: stable@vger.kernel.org
    >
    > Why did you feel we need to backport this to -stable?

    It's an extremely hard to hit security issue, but it's a security fix
    regardless. I won't cry if it doesn't go to stable, but it seems a
    trivial fix, so I included it for stable.

    -Kees

    --
    Kees Cook
    Chrome OS Security


    \
     
     \ /
      Last update: 2012-10-25 00:21    [W:2.090 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site