Date: Tue, 17 Aug 2021 18:02:51 +0000 From: Jeremy Stanley <fungi@...goth.org> To: oss-security@...ts.openwall.com Subject: Re: [OSSA-2021-004] Neutron: Linuxbridge ARP filter bypass on Netfilter platforms (CVE-2021-38598) On 2021-08-17 19:30:21 +0200 (+0200), Jan Engelhardt wrote: > > On Tuesday 2021-08-17 17:17, Jeremy Stanley wrote: > >Description > >~~~~~~~~~~~ > >Jake Yip with ARDC and Justin Mammarella with the University of > >Melbourne reported a vulnerability in Neutron's linuxbridge driver > >on newer Netfilter-based platforms (the successor to IPTables). > > ip_tables is running atop the netfilter API, so.... it's > not an ordered set with predecessors and successors. Yes, thanks. It would have been more accurate to draw the comparison between ebtables and ebtables-nft, which is where the underlying problem arises. I was trying not to get too into the weeds with technical detail for the general user audience, who may not be particularly aware of the names for layer 2 filtering mechanisms, but I agree this wording is also mildly misleading as a result. Should I have said "Netfilter-based platforms (the successor to legacy IPTables)" instead, to differentiate it from Netfilter-based IPTables? -- Jeremy Stanley Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.