oss-security - Re: [CVE-2023-42754] null pointer dereference in Linux kernel ipv4 stack

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 2 Oct 2023 22:21:06 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Kyle Zeng <zengyhkyle@...il.com>
Subject: Re: [CVE-2023-42754] null pointer dereference in Linux kernel ipv4 stack

On Mon, Oct 02, 2023 at 12:53:20PM -0700, Kyle Zeng wrote:
> when the skb is rerouted through ipvs, its skb->dev is NULL. Then the
> following `dev_net` call, which accesses `dev->nd_net`, becomes null
> pointer dereference.

When reporting issues like this, please always note the privileges
required for attack.  For the example above, it appears to be
CAP_NET_ADMIN within the namespace:

static int
do_ip_vs_set_ctl(struct sock *sk, int cmd, sockptr_t ptr, unsigned int len)
{
[...]
	if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
		return -EPERM;

I guess other possibilities for triggering this issue (if any) have
similar requirements.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.