Re: REJECTED: CVE-2025-0927: heap overflow in the hfs and hfsplus filesystems with manually crafted filesystem

["Theodore Ts'o" <tytso@mit.edu>]

On Mon, May 12, 2025 at 03:22:12PM +0200, Dmitry Vyukov wrote:
> 
> This is not even about auto-mount. Let's say I am mounting a flash
> drive that you gave me, how do I ensure it's a safe image to mount?
> Removable media, portable drives, and some use cases related to
> mounting images stored in local files either deal with images with
> unknown origin, or can't provide 100% guarantee that the image wasn't
> tempered with.

From my perspective, the answer is simple.

You run fsck -y on the file system image.  If fsck.FSTYP isn't capable
of sanitizding the file system image to make it be safe, then that
should be considered a security bug for fsck.FSTYP, and should be
reported as such.

Does the user not have the latest version of fsck?  Well, they should.
If they don't have the latest version of the kernel, or any other
system software in the TCB, then they could be unsafe.  And that's on
the user.

> Question of resources for fixing is orthogonal to classification of an
> issue (if it's a bug or not, if it's a security issue or not).

No, but the resources available should inform the trust model, and
assuming that users should be able to blindly insert any random USB
thumb drive, or blindly mounting any untrusted file system image, is
not a trust model that is realistic.

If you want a different trust model, then give me the resources.
Otherwise, don't try to impose an unfunded mandate on me.  Because I
will ignore you, for the sake of my mental health if nothing else.

     	    	     	      	 - Ted