Re: CVE-2024-40938: landlock: Fix d_parent walk

On Mon, Jul 15, 2024 at 01:16:38PM +0200, Greg Kroah-Hartman wrote:

On Mon, Jul 15, 2024 at 12:37:53PM +0200, Mickaël Salaün wrote:

quoted

Hello,

AFAIK, commit 88da52ccd66e ("landlock: Fix d_parent walk") doesn't fix a
security issue but an unexpected case.  The triggered WARN_ON_ONCE() is
just a canary, and this case was correctly handled with defensive
programming and didn't allow to bypass the security policy nor to harm
the kernel.  However, this fix should indeed be backported.

If a WARN_ON() is hit, a machine with panic_on_warn enabled will reboot,
hence if there is any way that userspace can hit this, it needs to be
issued a CVE, sorry.

OK, I didn't know about this panic_on_warn rule for CVE.  Out of
curiosity, panic_on_warn is definitely useful for fuzzing and testing,
but what is the rational to enable panic_on_warn on production systems?
It literally transforms a warning message into a system DoS (i.e.
WARN_ON into BUG_ON).  We should explicitly use BUG_ON() if this is a
critical unhandled case, right?

quoted

Could you please Cc me for future CVE related to my changes or to
Landlock?  For kernel CVEs, I think it would be good to Cc at least
maintainers, reviewers, authors, and committers for the related commits.

I suggest setting up lei to watch the linux-cve-announce mailing list if
you wish to do this (just filter for landlock stuff).  Automatically
mailing cve stuff to maintainers has been deemed too "noisy" which is
why we do not do this by default.

Well, it might be too noisy for some but I guess/hope not for most.
Email filtering should be easy for the few receiving too many of these
emails though.