From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from mail.kernel.org ([198.145.29.99]:57464 "EHLO mail.kernel.org"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1726401AbeLMUjx (ORCPT <rfc822;stable@vger.kernel.org>);
        Thu, 13 Dec 2018 15:39:53 -0500
Date: Thu, 13 Dec 2018 21:39:51 +0100
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Ben Hutchings <ben.hutchings@codethink.co.uk>
Cc: Sasha Levin <Alexander.Levin@microsoft.com>,
        stable <stable@vger.kernel.org>,
        Lorenzo Stoakes <lstoakes@gmail.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Willy Tarreau <w@1wt.eu>
Subject: Re: Fix for CVE-2018-1120 in 4.4
Message-ID: <20181213203951.GA14642@kroah.com>
References: <1544732664.19315.59.camel@codethink.co.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <1544732664.19315.59.camel@codethink.co.uk>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Thu, Dec 13, 2018 at 08:24:24PM +0000, Ben Hutchings wrote:
> I've backported changes to fix CVE-2018-1120 (denial of service via
> FUSE-backed /proc/PID/cmdline)�in 4.4-stable.  See
> <https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt>
> for an explanation of the issue.
> 
> This was already fixed in newer stable branches, but the fix depended
> on API changes made in 4.9.  The API changes are fairly straightforward
> and should be low risk, so the attached patches include those API
> changes.
> 
> I verified that the proof-of-concept no longer works after these
> changes, and that there were no regressions in the user-copy and vm
> self-tests.  I leave it to you to decide whether it's worthwhile to fix
> this in 4.4.

Wow, thanks for this, I never expected to see this happen, nice job.

All now queued up.

greg k-h