From: Dawson Engler <engler@csl.Stanford.EDU>
To: tytso@mit.edu (Theodore Tso)
Cc: hlein@progressive-comp.com (Hank Leininger),
linux-kernel@vger.kernel.org, alan@redhat.com
Subject: Re: [CHECKER] security rules? (and 2.4.5-ac4 security bug)
Date: Sat, 9 Jun 2001 19:13:36 -0700 (PDT) [thread overview]
Message-ID: <200106100213.TAA18780@csl.Stanford.EDU> (raw)
In-Reply-To: <20010609140718.A2570@think.thunk.org> from "Theodore Tso" at Jun 09, 2001 02:07:18 PM
> Indeed; the bug in the uuid_strategy which you pointed out in the
> random driver wasn't caused by the fact that we were using a
> user-specified length (since the length was being capped to a maximum
> value of 16). The security bug was that the test was done on a signed
> value, and copy_to_user() takes an unsigned value.
>
> So your checker found a real bug, but it wasn't the one that the
> checker thought it was. :-)
No, it was the bug the checker thought it was: a signed integer from
user space that had only been upper-bound checked. If the value had
been unsigned, or had been checked in a range lower_bound < x <
upper_bound there woulnd't have been a message.
But I certainly concede that the message could be more informative.
Dawson
next prev parent reply other threads:[~2001-06-10 2:14 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-06-04 12:20 Hank Leininger
2001-06-09 18:07 ` Theodore Tso
2001-06-10 2:13 ` Dawson Engler [this message]
-- strict thread matches above, loose matches on Subject: below --
2001-06-03 8:07 Dawson Engler
2001-06-03 11:22 ` Alan Cox
2001-06-08 11:24 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200106100213.TAA18780@csl.Stanford.EDU \
--to=engler@csl.stanford.edu \
--cc=alan@redhat.com \
--cc=hlein@progressive-comp.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®