oss-sec mailing list archives
CVE Request: Linux: IB/security: Restrict use of the write() interface'
From: Salvatore Bonaccorso <carnil () debian org>
Date: Sat, 7 May 2016 06:22:32 +0200
Hi Jann Horn reported an issue in the infiniband stack. It has been fixed in v4.6-rc6 with commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3: https://git.kernel.org/linus/e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3
IB/security: Restrict use of the write() interface The drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(). This is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead. For the immediate repair, detect and deny suspicious accesses to the write API. For long term, update the user space libraries and the kernel API to something that doesn't present the same security vulnerabilities (likely a structured ioctl() interface). The impacted uAPI interfaces are generally only available if hardware from drivers/infiniband is installed in the system.
Could you assign a CVE for this issue? I'm just to avoid possible duplication as well Cc'ing Red Hat's secalert, since the commit was signed off by Doug Ledford <dledford () redhat com>. Regards, Salvatore
Current thread:
- CVE Request: Linux: IB/security: Restrict use of the write() interface' Salvatore Bonaccorso (May 06)
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' cve-assign (May 07)
- Message not available
- Message not available
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' Yann Droneaud (May 09)
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' Jann Horn (May 09)
- Message not available
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' Yann Droneaud (May 09)
- Re: CVE Request: Linux: IB/security: Restrict use of the write() interface' ira.weiny (May 12)