scd: Have a limit for data object handling
Testing, NormalPublic
Actions

Assigned To

Authored By

	• gniibe
	Mon, Jun 1, 3:24 AM

Description

In scdaemon, there exists a possible DoS attack vector: a malicious/buggy device tries to return large DO by SW_MORE_DATA .

Reported by: Jakub Jelen, Found by AISLE in partnership with Red Hat

rG GnuPG
	rGab3b9c7709fd scd: Limit the size of data object returned from a device.

• gniibe triaged this task as Normal priority.Mon, Jun 1, 3:24 AM

• gniibe created this task.

• gniibe mentioned this in Unknown Object (Maniphest Task).

• gniibe changed the task status from Open to Testing.Tue, Jun 2, 3:56 AM

• gniibe shifted this object from the Restricted Space space to the S1 Public space.Mon, Jun 8, 3:21 AM

• gniibe changed the visibility from "g10code (Project)" to "All Users".

• gniibe changed the edit policy from "Custom Policy" to "All Users".

• gniibe changed the visibility from "All Users" to "Public (No Login Required)".

• gniibe mentioned this in Unknown Object (Maniphest Task).Mon, Jun 8, 3:32 AM