Re: [dm-crypt] About CVE-2016-4484: - Cryptsetup Initrd root Shell

[Arno Wagner <arno@wagner.name>]

On Wed, Nov 16, 2016 at 08:32:12 CET, Milan Broz wrote:
> On 11/16/2016 02:15 AM, Sven Eschenberg wrote:
> ...
> > 
> > There's a whole bunch of headlines among these lines. I've read that 
> > cryptsetup has a vulnerability exposing a root-shell on an encrypted 
> > system. Not quite so.
> 
> Yes, this is the real "contribution" of reporting a bug with
> (possibly even unrelated) project name in headlines.
> 
> But seems users themselves correct some stupid article comments,
> thanks for it! ;-)
> 
> Sometimes I wish security is less theater and more responsibility...
> (This bug cost me hours of explanation that upstream has nothing to fix
> and that in fact the cryptsetup/LUKS worked as designed.)

Tell me about it. I have these discussions regularly as a 
security consultant, simply because a lack of understanding
on customer side and attribution of errors by keyword-matching
instead. 

I think I will add a new section to the FAQ dealing with initrd
issues. 
Contens: 
1) No, the initrd is _not_ part of cryptsetup, it is your
   distro that screwed up if it is broken or insecure.
2) If you depend on the initrd doing something seucrely,
   roll your own and lock that down.
3) (Maybe an example...)

Regards,
Arno

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno@wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier