Re: [LTP] [PATCH v4] fsconfig03: New test CVE-2022-0185

[Petr Vorel <pvorel@suse.cz>]

Hi all,

I've tested various kernels, it looks like test works as expected
(older unpatched kernel fails, newer works, very old ones TCONF).

> There are reproducers available for CVE-2022-0185
> https://www.openwall.com/lists/oss-security/2022/01/25/14

> Also with links or even a zip file for an exploit
> https://github.com/Crusaders-of-Rust/CVE-2022-0185

> The exploits are kind of complicated as they try to be complete,
> but the exploitation vector is the fsconfig() syscall,
> this case used for add some coverage to that to detect it.

> When kernel < v5.15.16, you can easily reproduce crash use test case
> without check error and return logic in loop.

> I have used this test case trigger 5.14.1 kernel crash with ext2/4.

> Just make sure your kernel have not patched by following two commits:
> e192ccc17ecf3 - fix up param length parsing in legacy_parse_param
FYI: commit 722d94847de29310e8aa03fcbdb41fc92c521756 upstream.
=> that's a backport of 722d94847de29 we have in .tags in 5.15 stable branch.
This is not obvious, because the hash is different; also hash will be
different for for other kernel stable branches, e.g. in 5.10 stable it's
backported into eadde287a62e66b2f9e62d007c59a8f50d4b8413.

This is misleading, I first wondered if e192ccc17ecf3 shouldn't be in tags
(it shouldn't because it's a backport of 722d94847de29 => we don't put backports
there: "We don’t track all backports to stable kernel but just those which are
stable branch specific (unique), i.e. no commit in mainline. Example of commits:
c4a23c852e80, cac68d12c531." [1]).

Therefore I'd remove this whole section ("Just make sure...").

> cebe85d570cf8 - ext4: switch to the new mount api

I suppose test is now working as expected regardless kernel uses
the old mount API or the new one (from cebe85d570cf8), right?
Is this comment up to date?

Also, nit: kernel commits are usually put in form of hash ("..."), i.e.
e192ccc17ecf ("vfs: fs_context: fix up param length parsing in legacy_parse_param")

Kind regards,
Petr

[1] https://github.com/linux-test-project/ltp/wiki/C-Test-API#138-test-tags

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp