UFS Bug: FreeBSD 6.1/6.2/7.0: MOKB-08-11-2006, CVE-2006-5824, MOKB-03-11-2006, CVE-2006-5679

[O. Hartmann]

Scott Long wrote:
> O. Hartmann wrote:
>> Scott Long wrote:
>>> Kevin Oberman wrote:
>>>>> Date: Fri, 24 Nov 2006 15:58:39 -0700
>>>>> From: Scott Long <scottl at samsco.org>
>>>>> Sender: owner-freebsd-stable at freebsd.org
>>>>>
>>>>> David Malone wrote:
>>>>>
>>>>>>> These two bugs are shown for FreeBSD only and I guess, Solaris and
>>>>>>> other BSDs  still use UFS. Are they more robust against this
>>>>>>> exploit or type of exploit?
>>>>>> I don't know of a concerted effort by anyone to improve UFS in this
>>>>>> way. I would guess that the odd bug would have been resolved, but
>>>>>> no large scale work.
>>>>>>
>>>>>>     David.
>>>>> Another thing to keep in mind is that filesystem mounting is only
>>>>> available to the super-user.  If a feature came along such as
>>>>> automatically mounting USB drives, these bugs would indeed be
>>>>> critical.
>>>>> But for now, they are not.
>>>> Not on the base system, but Gnome 2.16 with hald running will mount a
>>>> removable device automatically. The standard configuration of Gnome
>>>> runs
>>>> hald. Allowing user mounts of removable media is even formalized by
>>>> the
>>>> addition of /media to hier(7). I'm not sure this should simply be
>>>> treated as not being significant.
>>> Would it be possible to restrict Gnome to only auto-mounting msdos and
>>> cd9660 filesystems?
>>>
>>> Scott
>>>
>>> _______________________________________________
>>> freebsd-stable at freebsd.org mailing list
>>> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
>>> To unsubscribe, send any mail to
>>> "freebsd-stable-unsubscribe at freebsd.org"
>> Sorry, if my question may sound heretic, but wouldn't it be more
>> sophisticated solving the problem instead of disabling everything what
>> could trigger the bug?
>
> Yup.  Who do you have in mind to do it?
>
> Scott
Well, this is a good question :-( I would like to do it if the following
prerequisites would be applicable:

I'm familiar with OS development (no)
I'm familiar with C, very close to driver layer and UFS (no)
I'm willing to work for a OpenSource project (yes, of course, I use
FreeBSD in scientific environment now for more than 10 years)

On the other hand, Scott, where are all the Kernel developer has been
gone to?

Oliver