Re: [PATCH] hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Apr 07, 2025 at 12:59:18PM +0200, Christian Brauner wrote:
> On Sun, Apr 06, 2025 at 07:07:57PM +0300, Cengiz Can wrote:
> > On 24-03-25 11:53:51, Greg KH wrote:
> > > On Mon, Mar 24, 2025 at 09:43:18PM +0300, Cengiz Can wrote:
> > > > In the meantime, can we get this fix applied?
> > > 
> > > Please work with the filesystem maintainers to do so.
> > 
> > Hello Christian, hello Alexander
> > 
> > Can you help us with this?
> > 
> > Thanks in advance!
> 
> Filesystem bugs due to corrupt images are not considered a CVE for any
> filesystem that is only mountable by CAP_SYS_ADMIN in the initial user
> namespace. That includes delegated mounting.

Thank you for the concise summary of this.  We (i.e. the kernel CVE
team) will try to not assign CVEs going forward that can only be
triggered in this way.

> The blogpost is aware that the VFS maintainers don't accept CVEs like
> this. Yet a CVE was still filed against the upstream kernel. IOW,
> someone abused the fact that a distro chose to allow mounting arbitrary
> filesystems including orphaned ones by unprivileged user as an argument
> to gain a kernel CVE.

Yes, Canonical abused their role as a CNA and created this CVE without
going through the proper processes.  kernel.org is now in charge of this
CVE, and:

> Revoke that CVE against the upstream kernel. This is a CVE against a
> distro. There's zero reason for us to hurry with any fix.

I will go reject this now.

Note, there might be some older CVEs that we have accidentally assigned
that can only be triggered by hand-crafted filesystem images.  If anyone
wants to dig through the 5000+ different ones we have, we will be glad
to reject them as well.

thanks,

greg k-h