Date: Tue, 9 Dec 2008 12:03:13 +0800 From: "Eugene Teo" <eugeneteo@...nel.sg> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: CVE request: kernel: enforce a minimum SG_IO timeout This requires a CVE name. Please assign one. Thanks. Alan Cox reported that libata needs to enforce sensible minimum timeouts on SG_IO requests otherwise a local, unprivileged user can trigger long spews of errors and forces the drives into PIO run as any user. To trigger this problem, you need to be able to open the cdrom device (i.e. login as a normal user from the console and then access it via ssh) or access to /dev/sg* which is root only in all sane systems. Upstream commit: f2f1fa78a155524b849edf359e42a3001ea652c0 Reference: https://bugzilla.redhat.com/show_bug.cgi?id=474495 Thanks, Eugene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.