oss-security - Re: kernel: hvc_console: Fix race between hvc_close and hvc

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 30 Jun 2010 23:06:41 -0600
From: dann frazier <dannf@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: kernel: hvc_console: Fix race between hvc_close
	and hvc_remove

On Sat, Apr 17, 2010 at 11:26:46PM -0400, Michael Gilbert wrote:
> On Sat, 17 Apr 2010 18:15:42 -0400 Michael Gilbert wrote:
> 
> > On Thu, 04 Mar 2010 17:03:58 +0800 Eugene Teo wrote:
> > 
> > > Heads-up. You might want to backport this if your kernel is affected. We 
> > > are not requesting a CVE name for this as it does not affect any of our 
> > > Red Hat supported kernels.
> > 
> > are you sure about this?  i see the vulnerable code upstream in both
> > 2.6.26 and 2.6.32.  does redhat not ship hvc in their kernels?  i think
> > this should get a cve id because the more vanilla distros will have
> > shipped with this included.
> 
> i see that hvc_console is disabled by default in the debian kernels,

Actually, upon review, I see that it is enabled (see the powerpc64
image). Therefore, I'd like to request a CVE ID for it.

> and i assume it is the same for the redhat kernels.
> 
> are issues in features that are disabled by default generally treated
> as unimportant? there are bound to be a (perhaps small) subset of users
> turning these features on; exposing themselves to more risk if these
> issues go unfixed. i suppose cve assignment depends on whether or not
> there is an expectation to protect those users in addition to
> defaults-using users. 
> 
> mike
> 

-- 
dann frazier

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.