Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 22 Jul 2021 22:30:45 +0000
From: Qualys Security Advisory <qsa@...lys.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE-2021-33909: size_t-to-int vulnerability in Linux's filesystem
 layer

Hi all,

A few people have asked us how we discovered CVE-2021-33909
(size_t-to-int conversion vulnerability in Linux's filesystem layer):

- We were reading (not auditing) the kernel code that generates some of
  the files in /proc/pid. We eventually reached seq_read_iter() and
  noticed the "while (1) { ... m->size <<= 1 ... }".

- We immediately wondered if there was a limit to this exponential
  growth; there was none. Next, we searched for /proc/pid seq_files
  whose records could become very large; and we knew from CVE-2020-28010
  that directory paths on Linux can be much longer than PATH_MAX.

- So we found show_mountinfo() (which generates /proc/pid/mountinfo) and
  the signed int buflen in the subsequent dentry_path(), which led to
  the out-of-bounds write of the "//deleted" string.

We are at your disposal for questions, comments, and further
discussions. Thank you very much! With best regards,

--
the Qualys Security Advisory team


[https://d1dejaj6dcqv24.cloudfront.net/asset/image/email-banner-384-2x.png]<https://www.qualys.com/email-banner>



This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete it. If you are not the intended recipient, do not read, copy, disclose or otherwise use this message. The sender disclaims any liability for such unauthorized use. NOTE that all incoming emails sent to Qualys email accounts will be archived and may be scanned by us and/or by external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.