Re: [PATCH] tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline()

On Sun, 16 Dec 2018 09:52:33 +0100 Greg KH gregkh@linuxfoundation.org wrote:

On Sat, Dec 15, 2018 at 06:25:37PM +0100, Loic wrote:

...

Hello,

Please picked up this patch for linux 4.4 and 4.9. This fixes CVE-2017-0605 (Rejected?). Tested in Debian ;)

It was rejected as a CVE for a good reason, and that reason is also why I refused to add it to the stable kernel releases. In short, this is not an issue or bug at all, there is nothing wrong with the existing code.

I'm starting to regret that I ever accepted the original patch :-(

-- Steve