[dm-crypt] About CVE-2016-4484: - Cryptsetup Initrd root Shell

Arno Wagner arno at wagner.name
Wed Nov 16 14:48:27 CET 2016


On Wed, Nov 16, 2016 at 08:32:12 CET, Milan Broz wrote:
> On 11/16/2016 02:15 AM, Sven Eschenberg wrote:
> ...
> > 
> > There's a whole bunch of headlines among these lines. I've read that 
> > cryptsetup has a vulnerability exposing a root-shell on an encrypted 
> > system. Not quite so.
> 
> Yes, this is the real "contribution" of reporting a bug with
> (possibly even unrelated) project name in headlines.
> 
> But seems users themselves correct some stupid article comments,
> thanks for it! ;-)
> 
> Sometimes I wish security is less theater and more responsibility...
> (This bug cost me hours of explanation that upstream has nothing to fix
> and that in fact the cryptsetup/LUKS worked as designed.)

Tell me about it. I have these discussions regularly as a 
security consultant, simply because a lack of understanding
on customer side and attribution of errors by keyword-matching
instead. 

I think I will add a new section to the FAQ dealing with initrd
issues. 
Contens: 
1) No, the initrd is _not_ part of cryptsetup, it is your
   distro that screwed up if it is broken or insecure.
2) If you depend on the initrd doing something seucrely,
   roll your own and lock that down.
3) (Maybe an example...)

Regards,
Arno

-- 
Arno Wagner,     Dr. sc. techn., Dipl. Inform.,    Email: arno at wagner.name
GnuPG: ID: CB5D9718  FP: 12D6 C03B 1B30 33BB 13CF  B774 E35C 5FA1 CB5D 9718
----
A good decision is based on knowledge and not on numbers. -- Plato

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier


More information about the dm-crypt mailing list