Date: Fri, 22 Aug 2014 01:04:26 +0530 (IST) From: P J P <ppandit@...hat.com> To: OSS Security List <oss-security@...ts.openwall.com> cc: security@...nel.org, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Yann Collet <yann.collet.73@...il.com> Subject: Re: incomplete fix for CVE-2014-4611: kernel: integer overflow in lz4_uncompress -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Marcus, +-- On Tue, 19 Aug 2014, Marcus Meissner wrote --+ | Jan Beulich writes in our bug for CVE-2014-4611: | | https://bugzilla.novell.com/show_bug.cgi?id=883949#c12 | | --- Comment #12 from Jan Beulich <jbeulich@...e.com> 2014-08-15 21:42:33 UTC --- | Except that it has been determined quite some time ago that all three fixes | having gone in upstream so far don't really fix anything. I posted a patch that | I think actually addresses the issue (https://lkml.org/lkml/2014/7/4/288), but | till now no-one cared to comment on it, apply it, or point out what's still | wrong, despite the ping 3 weeks later (https://lkml.org/lkml/2014/7/25/23). Jan's patch above does not seem right. It patches a non-existent function 'lz4_uncompress_unknownoutputs', and does not apply. $ git apply --check lz4-add-overrun-checks-to-lz4_uncompress_unknownoutputsize.patch error: patch failed: lib/lz4/lz4_decompress.c:89 error: lib/lz4/lz4_decompress.c: patch does not apply | Perhaps the kernel folks want to look at it again if they missed it so far. I've referred Jan's comment to Yann Collet(CC'd here). He is the creator of LZ4 and has agreed to create a saner patch for the said issue. We'll fix it soon. Thank you. - -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJT9knCAAoJEN0TPTL+WwQfHtMQALaHo4eTLxKIiDon/wDoJ3y6 OP3FPoLV8QkqdNOgejHp48lrPKxWLzlikCdtenKKWHTl8mTngTgrrCoMlS7IZZx2 TdhR40GCoQeHG/BEmGiuBSbxilgvxNcmvaYxpwHF6CHQhtR0TxROhVUrkYoigNp0 7BDEKt3wCypy/K5GP3mAdMrbGVSmGXqfviRxEBr3K9eBgYkjoxrhw9UcfUWUzIY4 kzqXwKYICJVW1+z4Zyk89KSx/BI1tA4l/A+94SUJB4GnP/nqz+APr2mzutZGB/BE 79F4YwfiP5E5+cRe+HUzQC1H1+LYdjMiTJov6tlNBhAigMErTWvR5pw5odQuts0S ivDeWPELOVUQyLjj6rDnBydHnMjOYJtImmLze5Nt+HgL+Buffg/ZaiDHC/TkPstQ oHO05AAPW8iyoOHwBEVmc2sJPRbndMSwBjq8uNLCv8aPrb+yXxQus8zfHRUVzBMD aM7oAyryY3f5DjGYxqm4GC9FZGUen4u/TC8dzGpPr7VZ8jViWwmFz0tSf0ivL4p5 tx6cgYGd6pvgBiZTXST0ZOLvyk1OyUYVt/bqb1nj/nxNDdrSE7vYB3l/5pePLgJe EpXOU13CZbNq7sGL+YcxzOZEJQsMQpgKDcweHxD6NJJYr4ut9GFGD5T42G3+K1IM kN0wJcUuEyQz5OD/6Hcl =c+qv -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.