From: Markus Armbruster <armbru@redhat.com>
To: Gerd Hoffmann <kraxel@redhat.com>
Cc: qemu-devel@nongnu.org, Bandan Das <bsd@redhat.com>,
public@hansmi.ch, Prasad J Pandit <ppandit@redhat.com>
Subject: Re: [Qemu-devel] [PATCH] usb-mtp: use O_NOFOLLOW and O_CLOEXEC.
Date: Thu, 13 Dec 2018 13:58:28 +0100 [thread overview]
Message-ID: <877egda8i3.fsf@dusky.pond.sub.org> (raw)
In-Reply-To: <20181213122511.13853-1-kraxel@redhat.com> (Gerd Hoffmann's message of "Thu, 13 Dec 2018 13:25:11 +0100")
Gerd Hoffmann <kraxel@redhat.com> writes:
> Open files and directories with O_NOFOLLOW to avoid symlinks attacks.
> While being at it also add O_CLOEXEC.
>
> usb-mtp only handles regular files and directories and ignores
> everything else, so users should not see a difference.
>
> Because qemu ignores symlinks carrying out an successfull symlink attack
> requires swapping an existing file or directory below rootdir for a
> symlink and winning the race against the inotify notification to qemu.
>
> Note that the impact of this bug is rather low when qemu is managed by
> libvirt due to qemu running sandboxed, so there isn't much you can gain
> access to that way.
>
> Fixes: CVE-2018-pjp-please-get-one
Ah, looks like we've run out of numbers.
> Cc: Prasad J Pandit <ppandit@redhat.com>
> Cc: Bandan Das <bsd@redhat.com>
> Reported-by: Michael Hanselmann <public@hansmi.ch>
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
next prev parent reply other threads:[~2018-12-13 12:58 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-13 12:25 [Qemu-devel] [PATCH] usb-mtp: use O_NOFOLLOW and O_CLOEXEC Gerd Hoffmann
2018-12-13 12:37 ` Daniel P. Berrangé
2018-12-13 12:40 ` Michael Hanselmann
2018-12-13 12:58 ` Markus Armbruster [this message]
2018-12-13 17:07 ` P J P
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877egda8i3.fsf@dusky.pond.sub.org \
--to=armbru@redhat.com \
--cc=bsd@redhat.com \
--cc=kraxel@redhat.com \
--cc=ppandit@redhat.com \
--cc=public@hansmi.ch \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.