From owner-freebsd-security@FreeBSD.ORG  Thu Feb  8 14:20:53 2007
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id BC13716A402
	for <freebsd-security@freebsd.org>;
	Thu,  8 Feb 2007 14:20:50 +0000 (UTC)
	(envelope-from nicolas@i.0x5.de)
Received: from n.0x5.de (n.0x5.de [217.197.85.144])
	by mx1.freebsd.org (Postfix) with ESMTP id 67F2E13C442
	for <freebsd-security@freebsd.org>;
	Thu,  8 Feb 2007 14:20:50 +0000 (UTC)
	(envelope-from nicolas@i.0x5.de)
Received: by pc5.i.0x5.de (Postfix, from userid 1003)
	id EAA9A61C1D; Thu,  8 Feb 2007 15:01:36 +0100 (CET)
Date: Thu, 8 Feb 2007 15:01:36 +0100
From: Nicolas Rachinsky <fbsd-security-0@ml.turing-complete.org>
To: freebsd-security@freebsd.org
Message-ID: <20070208140136.GA97987@mid.pc5.i.0x5.de>
Mail-Followup-To: freebsd-security@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Powered-by: FreeBSD
X-Homepage: http://www.rachinsky.de
X-PGP-Keyid: 887BAE72
X-PGP-Fingerprint: 039E 9433 115F BC5F F88D  4524 5092 45C4 887B AE72
X-PGP-Keys: http://www.rachinsky.de/nicolas/gpg/nicolas_rachinsky.asc
User-Agent: Mutt/1.5.13 (2006-08-11)
Subject: security issues of aio
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Feb 2007 14:20:53 -0000

Hallo,

in /sys/conf/NOTES there is a comment
| # Use real implementations of the aio_* system calls.  There are numerous
| # stability and security issues in the current aio code that make it
| # unsuitable for inclusion on machines with untrusted local users.
| options         VFS_AIO

Are there still problems with aio?

I only found http://xforce.iss.net/xforce/xfdb/7693, but no
advisory or other hint that this was fixed (I think I must have missed
that somehow). And some closed PRs about fixed problems.

Do these affect aio.ko as well?

Thanks,
Nicolas

-- 
http://www.rachinsky.de/nicolas