Date: Wed, 23 May 2018 08:57:45 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com> Cc: Vladis Dronov <vdronov@...hat.com> Subject: Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit On Wed, May 23, 2018 at 8:49 AM, Andrey Konovalov <andreyknvl@...il.com> wrote: > On Thu, May 10, 2018 at 2:05 PM, Vladis Dronov <vdronov@...hat.com> wrote: > > Hello, > > > > A null pointer dereference in dccp_write_xmit() function in > net/dccp/output.c > > in the Linux kernel before v4.16-rc7 allows a local user to cause a > denial of > > service by a number of certain crafted system calls. > So the classic CVE statement for this is "does it cross/violate a trust boundary". Yeah I know, not super helpful. In general when I look at something and need to decide whether or not it deserves/needs a CVE the fundamentals are: 1) Can an attacker use this vulnerability to gain access, additional privileges, basically is there an impact to Confidentiality/Availability/Integrity? This is really two tests: is there an impact, and is there a way for the attacker to trigger or exploit it? That's a CVE. 2) Does the software/system make a specific security claim that they then fail to meet? E.g. "we include a firewall that blocks access to everything inbound except for port 22", if they were to then also allow port 80, that'd be a CVE. So for the syzbot stuff mostly what you need to determine is: a) is there a security related impact? AND b) can an attacker trigger it? If both are yes, then a CVE is warranted. > > > > References: > > > > https://syzkaller.appspot.com/bug?id=833568de043e0909b2aeaef7be136d > b39d21ba94 > > > > https://marc.info/?t=152036611500003&r=1&w=2 > > > > An upstream patch: > > > > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/ > linux.git/commit/?id=67f93df79aeefc3add4e4b31a752600f834236e2 > > > > Best regards, > > Vladis Dronov | Red Hat, Inc. | Product Security Engineer > > Hi Vladis, > > I've been wondering, how do you choose which bugs you request CVEs > for? Syzbot reported a few hundreds of them over the last few months > and a decent fraction of them looks scarier than a null pointer > dereference. > > Thanks! > -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.