lkml.org 
[lkml]   [2013]   [Jun]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH] CVE fix for xen-blkback allowing DISCARD operations on read-only disks.
Date
Please put the following patch:
[PATCH] xen/blkback: Check device permissions before allowing

in your tree for Linus. It fixes CVE-2013-2140.

The bug is that if a system admin provides a disk (which supports
the discard aka TRIM or SCSI UNMAP) to a guest as read-only - there
are no checks done. Which means that the OS can destroy the data.

The likehood of somebody using 'ro' disks I think is small - but
there is probably one person who does it and would be unhappy that
a guest OS can destroy the underlaying data.


\
 
 \ /
  Last update: 2013-06-05 22:41    [W:0.036 / U:0.080 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site