![]() |
|
Message-ID: <ZRsnx11QaUs1dQAp@westworld> Date: Mon, 2 Oct 2023 13:27:51 -0700 From: Kyle Zeng <zengyhkyle@...il.com> To: Solar Designer <solar@...nwall.com> Cc: oss-security@...ts.openwall.com Subject: Re: [CVE-2023-42754] null pointer dereference in Linux kernel ipv4 stack On Mon, Oct 02, 2023 at 10:21:06PM +0200, Solar Designer wrote: > On Mon, Oct 02, 2023 at 12:53:20PM -0700, Kyle Zeng wrote: > > when the skb is rerouted through ipvs, its skb->dev is NULL. Then the > > following `dev_net` call, which accesses `dev->nd_net`, becomes null > > pointer dereference. > > When reporting issues like this, please always note the privileges > required for attack. For the example above, it appears to be > CAP_NET_ADMIN within the namespace: Yes, to the best of my knowledge, CAP_NET_ADMIN is required for triggering the bug (at least for the attached proof-of-concept code), which can be obtained in user namespace (enabled by default in most desktop environments). And thank you for letting me know. I will report the privilege requirement properly next time. Best, Kyle Zeng
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.