Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 30 May 2017 09:03:33 -0400
From: Daniel Micay <danielmicay@...il.com>
To: Florian Weimer <fweimer@...hat.com>, oss-security@...ts.openwall.com
Cc: Roee Hay <roeehay@...il.com>
Subject: Re: Linux kernel: stack buffer overflow with
 controlled payload in get_options() function

On Tue, 2017-05-30 at 14:52 +0200, Florian Weimer wrote:
> On 05/30/2017 01:51 PM, Daniel Micay wrote:
> > It's unreasonable to consider the kernel line untrusted. A CVE being
> > issued for one of these issues didn't make sense.
> 
> It's a potential Secure Boot bypass, so it matters in some theoretical
> sense to some downstreams which carry those Secure Boot patches.

Also not sure what you mean by patches. Secure boot doesn't require
applying patches. The kernel has to be verified by an early boot chain
and dm-verity is in mainline for verifying the rest of the OS as Android
and ChromeOS do. Android does have some tweaks for dm-verity but they're
workarounds for bureaucracy rather than true technical requirements.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ