[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 2 Oct 2023 13:27:51 -0700
From: Kyle Zeng <zengyhkyle@...il.com>
To: Solar Designer <solar@...nwall.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: [CVE-2023-42754] null pointer dereference in
Linux kernel ipv4 stack
On Mon, Oct 02, 2023 at 10:21:06PM +0200, Solar Designer wrote:
> On Mon, Oct 02, 2023 at 12:53:20PM -0700, Kyle Zeng wrote:
> > when the skb is rerouted through ipvs, its skb->dev is NULL. Then the
> > following `dev_net` call, which accesses `dev->nd_net`, becomes null
> > pointer dereference.
>
> When reporting issues like this, please always note the privileges
> required for attack. For the example above, it appears to be
> CAP_NET_ADMIN within the namespace:
Yes, to the best of my knowledge, CAP_NET_ADMIN is required for triggering
the bug (at least for the attached proof-of-concept code), which can be
obtained in user namespace (enabled by default in most desktop environments).
And thank you for letting me know. I will report the privilege
requirement properly next time.
Best,
Kyle Zeng
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
