[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 6 Jul 2015 05:23:11 -0400 (EDT)
From: cve-assign@...re.org
To: benh@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, carnil@...ian.org
Subject: Re: CVE Request: UDP checksum DoS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
>> However, the presence of "return -EAGAIN" may also have been a
>> security problem in some realistic circumstances. For example, maybe
>> there's an attacker who can't transmit a flood with invalid checksums,
>> but can sometimes inject one packet with an invalid checksum. The
>> goal of this attacker isn't to cause a system hang; the goal is to
>> cause an EPOLLET epoll application to stop reading for an indefinitely
>> long period of time. This scenario can't also be covered by
>> CVE-2015-5364. Is it better to have no CVE ID at all, e.g., is
>> udp_recvmsg/udpv6_recvmsg simply not intended to defend against this
>> scenario?
> It seems reasonable to assign a second CVE ID to that issue.
Use CVE-2015-5366.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVmkgoAAoJEKllVAevmvmsCWkH/1xhstkTg/oWb95ua9Jvr6rR
hLq8qVNZoel+2k5/73YIkxOAi5UvNPn3/sb75p2vggTIeXhdLK6hJw8nUTRItyUR
UhAWrwISpnOxHGKuVOjPoH4e9ujZLNXxDopZW0+eIJLh+Wb3ek00ohJhMNF4Cp5J
9vi759xuM/yNsOqkXE7daIWEHSgkjw1jTs43Hh4L6vV8ixuFN/mNM+u+ljiEGO1/
/SMDUS3ByZKJ+B7odl4fa9s4EB7BO8x0dvZlWeWaGLNShq30nYItpGGJ799lVS81
3JGqrUeqgUumyuy72bd0NtAH1IViOnkHV9MBBFB/G9Whl959h0xdrOiGJh3dxAw=
=GBxR
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
