Greg KH wrote: > On Wed, Oct 22, 2008 at 11:21:08AM -0500, Eric Sandeen wrote: >> Greg KH wrote: >>> On Wed, Oct 22, 2008 at 10:11:52AM -0500, Eric Sandeen wrote: >>>> This is a trivial backport of the following upstream commits: >>>> >>>> - bd39597cbd42a784105a04010100e27267481c67 (ext2) >>>> - cdbf6dba28e8e6268c8420857696309470009fd9 (ext3) >>>> - 9d9f177572d9e4eba0f2e18523b44f90dd51fe74 (ext4) >>>> >>>> This addresses CVE-2008-3528 >>>> >>>> ext[234]: Avoid printk floods in the face of directory corruption >>> For what kernel releases is this applicable? .27? .26? .25? Earlier? >> Sorry.. it is applicable to pretty much any kernel in the past :) .27 >> certainly (that's what the patch is against), .26, .25.... yes. >> >> It's not a particularly dangerous condition - you have to somehow get >> the administrator to mount the filesystem before you can trigger the >> "exploit" (which is a DoS, essentially) - so, I don't know if it's worth >> porting back to the dawn of time... > > Well, I will not port it back to older kernels than .25, so that's not a > big deal. > > As for the "admin mount a filesystem", you could put an ext2/3 fs on a > usb stick and plug it into a box. It will be mounted automatically, no > admin rights required, and the DoS would happen, right? If I wanted to DoS a box sitting in front of me, I'd just pull the plug. -Eric -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
