Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 17 Aug 2021 18:02:51 +0000
From: Jeremy Stanley <>
Subject: Re: [OSSA-2021-004] Neutron: Linuxbridge ARP filter
 bypass on Netfilter platforms (CVE-2021-38598)

On 2021-08-17 19:30:21 +0200 (+0200), Jan Engelhardt wrote:
> On Tuesday 2021-08-17 17:17, Jeremy Stanley wrote:
> >Description
> >~~~~~~~~~~~
> >Jake Yip with ARDC and Justin Mammarella with the University of
> >Melbourne reported a vulnerability in Neutron's linuxbridge driver
> >on newer Netfilter-based platforms (the successor to IPTables).
> ip_tables is running atop the netfilter API, so.... it's
> not an ordered set with predecessors and successors.

Yes, thanks. It would have been more accurate to draw the comparison
between ebtables and ebtables-nft, which is where the underlying
problem arises. I was trying not to get too into the weeds with
technical detail for the general user audience, who may not be
particularly aware of the names for layer 2 filtering mechanisms,
but I agree this wording is also mildly misleading as a result.

Should I have said "Netfilter-based platforms (the successor to
legacy IPTables)" instead, to differentiate it from Netfilter-based
Jeremy Stanley

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.