From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756376AbcEaIQ4 (ORCPT ); Tue, 31 May 2016 04:16:56 -0400 Received: from out4133-34.mail.aliyun.com ([42.120.133.34]:23514 "EHLO out4133-34.mail.aliyun.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756038AbcEaIQu convert rfc822-to-8bit (ORCPT ); Tue, 31 May 2016 04:16:50 -0400 X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R171e4;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e02c03307;MF=hillf.zj@alibaba-inc.com;NM=1;PH=DS;RN=2;SR=0;TI=SMTPD_----4s9SwyO_1464682590; Reply-To: "Hillf Danton" From: "Hillf Danton" To: Cc: "linux-kernel" References: <005101d1bb12$a184dea0$e48e9be0$@alibaba-inc.com> In-Reply-To: <005101d1bb12$a184dea0$e48e9be0$@alibaba-inc.com> Subject: Re: Vulnerability [CVE-2014-4608] recurs in Linux 3.17.2-4.5 Date: Tue, 31 May 2016 16:16:30 +0800 Message-ID: <005501d1bb14$bc9338c0$35b9aa40$@alibaba-inc.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8BIT X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQFStdJ1ImmylKcG475gKh4me05vJqDQuaRg Content-Language: zh-cn Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org > > Dear Sir/Madam: > I'm a postgraduate student majoring in information security and > I'm very interested in software vulnerabilities, I think it's really > fascinating and I'm doing some research about how to find > vulnerabilities automatically. I have done some tests with Linux bug > commits. And I found that the patch codes ( fixing CVE-2014-4608 ) > didn't appear in the version 3.17.2 to 4.5. I'm just wondering if this > means the vulnerability ( CVE-2014-4608 ) recurs in Linux 3.17.2-4.5. > If not, is it fixed in another way? > Thanks for your time, I'll appreciate it very much if you can give > an answer. > > p.s. here is the link to CVE-2014-4608 report > http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=206a81c18401 \ > c0cde6e579164f752c4b147324ce > > Best regards > > ZhiJun DENG > Cluster and Grid Computing Laboratory > HuaZhong University Of Science And Technology > 1037 Luoyu Road,Wuhan,430074,China > Tel:+86 - 15527287870 > > Email锛�506012274@qq.com > Hi ZhiJun DENG In linux-4.7-rc1 the log says, 1, 206a81c18401 ("lzo: properly check for overruns") was reverted by af958a38a60c ("Revert "lzo: properly check for overruns"") 2, then it was fixed in 72cf90124e8 ("lzo: check for length overrun in variable length encoding.") btw, please send email in pure text to LKML. Hillf