Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 01 Oct 2014 14:04:36 -0400
From: Andrew Tappert <andrew@...ewerks.com>
To: oss-security@...ts.openwall.com
CC: Tom O'Connor <toconnor@...ewerks.com>
Subject: CVE Request: linux kernel net_get_random_once bug


My colleague Tom O'Connor and I have identified a security bug in the
Linux kernel that results in drastically degraded randomness of IP IDs,
TCP sequence numbers, and ephemeral port numbers on affected systems.
The bug existed in kernel versions 3.13 and 3.14.  We are posting here
rather than to the private "distros" list because the bug has already
been fixed.  However, we don't think that the security implications of
the bug have been acknowledged anywhere, and we think it needs a CVE.  A
full write-up on the bug is posted at
http://secondlookforensics.com/ngro-linux-kernel-bug/.

-- 
Andrew Tappert
Raytheon Cyber Products
http://secondlookforensics.com/


Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.