oss-security - CVE request - Linux kernel - Unix sockets use after free

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 18 Nov 2015 02:57:37 -0500 (EST)
From: Wade Mealing <wmealing@...hat.com>
To: OSS Security List <oss-security@...ts.openwall.com>
Cc: cve-assign@...re.org
Subject: CVE request - Linux kernel - Unix sockets use after free -
 peer_wait_queue prematurely freed

Gday,

A flaw was found in the Linux kernels implementation of Unix sockets(AF_UNIX).  A
server polling for data coming from a client socket may put the peer
socket on a wait list.  This peer may close the connection making
the reference on the wait list no longer valid. A determined attacker
could poison this memory and lead to bypassing permissions on a the socket, 
and packets being injected into the stream.  This may also panic the machine.

Thanks,

Wade Mealing

Original discussion:
- https://groups.google.com/forum/#!topic/syzkaller/3twDUI4Cpm8

Upstream patch:
- Patch discussion available at the same url, no final patch at the time of writing

Red Hat Bugzilla:
- https://bugzilla.redhat.com/show_bug.cgi?id=1282688

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.