[kernel-sec-discuss] r1660 - active retired
Michael Gilbert
gilbert-guest at alioth.debian.org
Sat Dec 19 21:03:31 UTC 2009
Author: gilbert-guest
Date: 2009-12-19 21:03:31 +0000 (Sat, 19 Dec 2009)
New Revision: 1660
Added:
retired/CVE-2004-2135
Removed:
active/CVE-2004-2135
Log:
retire cyptoloop issue
Deleted: active/CVE-2004-2135
===================================================================
--- active/CVE-2004-2135 2009-12-19 21:03:22 UTC (rev 1659)
+++ active/CVE-2004-2135 2009-12-19 21:03:31 UTC (rev 1660)
@@ -1,30 +0,0 @@
-Candidate: CVE-2004-2135
-Description:
- cryptoloop on Linux kernel 2.6.x, when used on certain file systems with a block
- size 1024 or greater, has certain "IV computation" weaknesses that allow watermarked
- files to be detected without decryption.
-References:
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2135
- http://mareichelt.de/pub/notmine/diskenc.pdf
- http://mareichelt.de/pub/texts.cryptoloop.php?alt_styles=2
-Notes:
- jmm> IIRC there was some serious flaming about the different disk encryption systems,
- jmm> I'm not sure whether this has been addressed or how real it is
- jmm> Plus, cryptoloop is marked DEPRECATED for a long time IIRC
- jmm> It's not included in stock 2.4 kernels, but only available in kernel-patch-cryptoloop,
- jmm> which is only part of sid and hasn't been shipped with neither Woody nor Sarge, so
- jmm> I'm marking all these N/A
- - i am 99% sure that these issues still affect the latest kernels
- - debian-installer only supports loop-aes and dm-crypt (i believe),
- which are known to be not affected by these issues, so most users
- are not affected
- - perhaps a solution would be to disable cryptoloop?
- - i have started an lkml thread: http://lkml.org/lkml/2009/12/2/232, but it appears
- that there is no longer any interest in the problems...
- jmm> Disabled in 2.6.32-2
-Bugs:
-upstream:
-linux-2.6: released (2.6.32-2)
-2.6.18-etch-security: ignored
-2.6.24-etch-security: ignored
-2.6.26-lenny-security: ignored
Copied: retired/CVE-2004-2135 (from rev 1659, active/CVE-2004-2135)
===================================================================
--- retired/CVE-2004-2135 (rev 0)
+++ retired/CVE-2004-2135 2009-12-19 21:03:31 UTC (rev 1660)
@@ -0,0 +1,29 @@
+Candidate: CVE-2004-2135
+Description:
+ cryptoloop on Linux kernel 2.6.x, when used on certain file systems with a block
+ size 1024 or greater, has certain "IV computation" weaknesses that allow watermarked
+ files to be detected without decryption.
+References:
+ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2135
+ http://mareichelt.de/pub/notmine/diskenc.pdf
+ http://mareichelt.de/pub/texts.cryptoloop.php?alt_styles=2
+Notes:
+ jmm> IIRC there was some serious flaming about the different disk encryption systems,
+ jmm> I'm not sure whether this has been addressed or how real it is
+ jmm> Plus, cryptoloop is marked DEPRECATED for a long time IIRC
+ jmm> It's not included in stock 2.4 kernels, but only available in kernel-patch-cryptoloop,
+ jmm> which is only part of sid and hasn't been shipped with neither Woody nor Sarge, so
+ jmm> I'm marking all these N/A
+ - i am 99% sure that these issues still affect the latest kernels
+ - debian-installer only supports loop-aes and dm-crypt (i believe),
+ which are known to be not affected by these issues, so most users
+ are not affected
+ - i have started an lkml thread: http://lkml.org/lkml/2009/12/2/232, but it appears
+ that there is no longer any interest in the problems...
+ jmm> Disabled in 2.6.32-2
+Bugs:
+upstream:
+linux-2.6: released (2.6.32-2)
+2.6.18-etch-security: N/A "introduces significant change in funtionality; minor issue"
+2.6.24-etch-security: N/A "introduces significant change in funtionality; minor issue"
+2.6.26-lenny-security: N/A "introduces significant change in funtionality; minor issue"
More information about the kernel-sec-discuss
mailing list