From: Scott Lovenberg <scott.lovenberg-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: Taesoo Kim <taesoo-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org>
Cc: Taesoo Kim <tsgatesv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
"sfrench-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org"
<sfrench-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org>,
linux-cifs <linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
samba-technical-w/Ol4Ecudpl8XjKLYN78aQ@public.gmane.org,
LKML <linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
changwoo-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org,
sanidhya-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org,
blee-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org,
csong84-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org
Subject: Re: [PATCH 1/1] cifs: potential memory leaks when parsing mnt opts
Date: Sat, 21 Mar 2015 22:54:58 -0500 [thread overview]
Message-ID: <CAFB9KM0fDCJ+gHcW0ZyNQdWhraGredJCdBT1AO0GqK4ibFEvYQ@mail.gmail.com> (raw)
In-Reply-To: <20150322032340.GD5170-Q1ymHw66ZoYdnm+yROfE0A@public.gmane.org>
On Sat, Mar 21, 2015 at 10:23 PM, Taesoo Kim <taesoo-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org> wrote:
> On 03/21/15 at 09:10pm, Scott Lovenberg wrote:
>> On Sat, Mar 21, 2015 at 6:08 PM, Taesoo Kim <tsgatesv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> wrote:
>>
>> > Althouhg mkfs.cifs in userspace performs a bit of sanitization
>> > (e.g., forcing one user option), current implementation is not
>> > robust. Other options such as iocharset and domainanme are similary
>> > vulnerable.
>> >
>>
>> I assume you mean mount.cifs? :-) Anyways, good catch.
>
> Right. FYI, I've tried mangling password field (e.g., pass=a,user=A
> &c); Skimming through the code (just a few minutes), there are a few
> potential places that don't sanitize its string, unlike passwd. But
> don't have much time to play with for now :)
>
> Thanks,
> Taesoo
>
>> --
>> Peace and Blessings,
>> -Scott.
Without even looking at the code, I can tell you that's probably my
fault if you're talking about the code in mount.cifs. I was pretty
paranoid about the password field but not so paranoid about the other
parameters. I'll take a look late tonight or some time tomorrow and
try to patch over my shame. :)
--
Peace and Blessings,
-Scott.
WARNING: multiple messages have this Message-ID (diff)
From: Scott Lovenberg <scott.lovenberg@gmail.com>
To: Taesoo Kim <taesoo@gatech.edu>
Cc: Taesoo Kim <tsgatesv@gmail.com>,
"sfrench@samba.org" <sfrench@samba.org>,
linux-cifs <linux-cifs@vger.kernel.org>,
samba-technical@lists.samba.org,
LKML <linux-kernel@vger.kernel.org>,
changwoo@gatech.edu, sanidhya@gatech.edu, blee@gatech.edu,
csong84@gatech.edu
Subject: Re: [PATCH 1/1] cifs: potential memory leaks when parsing mnt opts
Date: Sat, 21 Mar 2015 22:54:58 -0500 [thread overview]
Message-ID: <CAFB9KM0fDCJ+gHcW0ZyNQdWhraGredJCdBT1AO0GqK4ibFEvYQ@mail.gmail.com> (raw)
In-Reply-To: <20150322032340.GD5170@taesoo.org>
On Sat, Mar 21, 2015 at 10:23 PM, Taesoo Kim <taesoo@gatech.edu> wrote:
> On 03/21/15 at 09:10pm, Scott Lovenberg wrote:
>> On Sat, Mar 21, 2015 at 6:08 PM, Taesoo Kim <tsgatesv@gmail.com> wrote:
>>
>> > Althouhg mkfs.cifs in userspace performs a bit of sanitization
>> > (e.g., forcing one user option), current implementation is not
>> > robust. Other options such as iocharset and domainanme are similary
>> > vulnerable.
>> >
>>
>> I assume you mean mount.cifs? :-) Anyways, good catch.
>
> Right. FYI, I've tried mangling password field (e.g., pass=a,user=A
> &c); Skimming through the code (just a few minutes), there are a few
> potential places that don't sanitize its string, unlike passwd. But
> don't have much time to play with for now :)
>
> Thanks,
> Taesoo
>
>> --
>> Peace and Blessings,
>> -Scott.
Without even looking at the code, I can tell you that's probably my
fault if you're talking about the code in mount.cifs. I was pretty
paranoid about the password field but not so paranoid about the other
parameters. I'll take a look late tonight or some time tomorrow and
try to patch over my shame. :)
--
Peace and Blessings,
-Scott.
next prev parent reply other threads:[~2015-03-22 3:54 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-21 23:08 [PATCH 1/1] cifs: potential memory leaks when parsing mnt opts Taesoo Kim
2015-03-21 23:08 ` Taesoo Kim
[not found] ` <1426979310-31201-1-git-send-email-tsgatesv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2015-03-22 2:10 ` Scott Lovenberg
2015-03-22 2:10 ` Scott Lovenberg
[not found] ` <CAFB9KM3==40uUXxxOD_CD09zFPj3Fmr-Brt7x4SZj86NTf3_vg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2015-03-22 3:23 ` Taesoo Kim
2015-03-22 3:23 ` Taesoo Kim
[not found] ` <20150322032340.GD5170-Q1ymHw66ZoYdnm+yROfE0A@public.gmane.org>
2015-03-22 3:54 ` Scott Lovenberg [this message]
2015-03-22 3:54 ` Scott Lovenberg
2015-03-24 4:43 ` Steve French
2015-03-24 4:43 ` Steve French
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAFB9KM0fDCJ+gHcW0ZyNQdWhraGredJCdBT1AO0GqK4ibFEvYQ@mail.gmail.com \
--to=scott.lovenberg-re5jqeeqqe8avxtiumwx3w@public.gmane.org \
--cc=blee-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org \
--cc=changwoo-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org \
--cc=csong84-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org \
--cc=linux-cifs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=samba-technical-w/Ol4Ecudpl8XjKLYN78aQ@public.gmane.org \
--cc=sanidhya-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org \
--cc=sfrench-eUNUBHrolfbYtjvyW6yDsg@public.gmane.org \
--cc=taesoo-/4noJB3qBVQ3uPMLIKxrzw@public.gmane.org \
--cc=tsgatesv-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.