Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 10 Sep 2020 00:30:40 +0200
From: Kai Lüke <kai@...volk.io>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2020-14386: Linux kernel: af_packet.c vulnerability

Hello,

here are some words on whether related issues to CVE-2020-14386 could
exist in similar software.

There are of course forks of Linux which get updates slower or not
at all. The Android mainline branch at least has the fix already.
In case of µClinux I found trees that are kept on old versions with no
plans to update to newer major versions (for example, the GitHub
project EmcraftSystems/linux-emcraft is on 2.6.33).

Implementations of the Linux syscall ABI are getting more common.
I didn't test the Windows WSL and WSL2 situation. For WSL I don't
know if they implement support for RAW sockets and for WSL2 it
likely means that the virtualized Linux kernel crashes. However,
I tried to reproduce the bug with gVisor and FreeBSD.

With gVisor and the default Go network stack it was not possible to
open the RAW socket inside the runsc sandbox and a permission error
was reported. This error went away when using the Linux host network
stack and resulted in the new error
"Address family not supported by protocol" which suggests that support
for RAW sockets is not implemented but I didn't confirm it in the
source code. I think that non-race memory corruptions are rare in Go.

On FreeBSD and the Linux binary compatibility mode enabled I also got
"Address family not supported by protocol" but here as well I didn't
consult the source code to confirm that support for RAW sockets is
indeed not implemented. I don't know if a native feature like
PACKET_RESERVE exists.

Regards,
Kai



-- 
Kinvolk GmbH | Adalbertstr.6a, 10999 Berlin | tel: +491755589364

Geschäftsführer/Directors: Alban Crequy, Chris Kühl, Iago López Galeiras

Registergericht/Court of registration: Amtsgericht Charlottenburg

Registernummer/Registration number: HRB 171414 B

Ust-ID-Nummer/VAT ID number: DE302207000

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.