[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] Re: CVE Request: Squashfs 4.2 Race Condition
From:       Jeremy Stanley <jeremy () openstack ! org>
Date:       2015-12-31 13:54:55
Message-ID: 20151231135455.GP2344 () openstack ! org
[Download RAW message or body]

On 2015-12-31 06:29:55 +0900 (+0900), Jihyeok Seo wrote:
[...]
> However, firmware upgrade procedures (remote or local) which uses
> unsquashfs, on devices such as network routers, could be crashed
> with an untrusted Squashfs filesystem image and lead to denial of
> service.

To reasonably consider that an exploit, you first have to ask
whether there are easier ways for an untrusted firmware upgrade
image to crash devices such as network routers. It seems like if you
are willing to load an untrusted firmware onto your router, having a
patched Squashfs is the least of your worries?
-- 
Jeremy Stanley
[prev in list] [next in list] [prev in thread] [next in thread]