Bugs triggered by crafted file system images are among the most frequently reported non-security issues, often with the argument that some desktop environments automatically mount removable media without checking them. Let's state that automatic mounting of unchecked file systems does not change the analysis: an automounter is expected to check a file system before mounting it, otherwise it is at fault, and if the check does not detect the issue, the file system checker is at fault (this doesn't void the need to handle the kernel side of the report). Fixes should then be directed to these tools. The only exception remains drivers specifically documented as being hardened against hostile inputs, as already stated for non-conforming devices and media. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Willy Tarreau --- Documentation/process/threat-model.rst | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Documentation/process/threat-model.rst b/Documentation/process/threat-model.rst index 72cb36dd383d6..b82d5d168b4c3 100644 --- a/Documentation/process/threat-model.rst +++ b/Documentation/process/threat-model.rst @@ -234,7 +234,12 @@ The following classes of problems are not considered as vulnerabilities: image: mounting a block device is a privileged operation (see above), and the administrator is responsible for the media they mount. This includes issues that are resolved, mitigated, or detected by running a filesystem - consistency check (fsck) on the image prior to mounting. + consistency check (fsck) on the image prior to mounting. Automatic + mounting of unchecked file systems (e.g. removable media mounted by a + desktop environment) does not change this: an automounter is expected to + check a file system before mounting it, otherwise it is at fault, and if + the check does not detect the issue, the file system checker is at fault. + In such cases, fixes should be directed to these tools. * bugs whose reproduction requires hardware modification or emulation, including fake USB devices that pretend to be another one, or devices -- 2.52.0