Date: Mon, 6 Jul 2015 05:23:11 -0400 (EDT) From: cve-assign@...re.org To: benh@...ian.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, carnil@...ian.org Subject: Re: CVE Request: UDP checksum DoS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> However, the presence of "return -EAGAIN" may also have been a >> security problem in some realistic circumstances. For example, maybe >> there's an attacker who can't transmit a flood with invalid checksums, >> but can sometimes inject one packet with an invalid checksum. The >> goal of this attacker isn't to cause a system hang; the goal is to >> cause an EPOLLET epoll application to stop reading for an indefinitely >> long period of time. This scenario can't also be covered by >> CVE-2015-5364. Is it better to have no CVE ID at all, e.g., is >> udp_recvmsg/udpv6_recvmsg simply not intended to defend against this >> scenario? > It seems reasonable to assign a second CVE ID to that issue. Use CVE-2015-5366. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVmkgoAAoJEKllVAevmvmsCWkH/1xhstkTg/oWb95ua9Jvr6rR hLq8qVNZoel+2k5/73YIkxOAi5UvNPn3/sb75p2vggTIeXhdLK6hJw8nUTRItyUR UhAWrwISpnOxHGKuVOjPoH4e9ujZLNXxDopZW0+eIJLh+Wb3ek00ohJhMNF4Cp5J 9vi759xuM/yNsOqkXE7daIWEHSgkjw1jTs43Hh4L6vV8ixuFN/mNM+u+ljiEGO1/ /SMDUS3ByZKJ+B7odl4fa9s4EB7BO8x0dvZlWeWaGLNShq30nYItpGGJ799lVS81 3JGqrUeqgUumyuy72bd0NtAH1IViOnkHV9MBBFB/G9Whl959h0xdrOiGJh3dxAw= =GBxR -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.