[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <e7aa3dbb-4bbb-45ce-b4c8-f7de7c01cd89@gmail.com>
Date: Fri, 22 May 2026 18:56:40 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: oss-security@...ts.openwall.com, Hyunwoo Kim <imv4bel@...il.com>,
Solar Designer <solar@...nwall.com>
Cc: Sultan Alsawaf <sultan@...neltoast.com>
Subject: Re: Linux kernel: Dirty Frag variants — fix merged into netdev
On 5/21/26 14:25, Hyunwoo Kim wrote:
> On Thu, May 21, 2026 at 08:06:41PM +0200, Solar Designer wrote:
>> Hi,
>>
>> On Fri, May 22, 2026 at 02:19:42AM +0900, Hyunwoo Kim wrote:
(snip)
>>> 4. https://github.com/v12-security/pocs/tree/main/fragnesia-5db89c99566fc (2026-05-15)
>>>
>>> Note that the fourth PoC was confirmed to be blocked as well by the v3
>>> fix (skb_gro_receive) [1] that resolves the third PoC,
>>
>> This matches Sultan's analysis. It may be that the rediscovery by V12
>> was based on Sultan's public posting on the issue (including exploit).
>> I called them out on this in their Twitter thread and got no reply.
>>
>>> and the v4 [2] and v5 [3] changes address potential issues.
>>>
>>> As long as the in-place path in esp remains, further variants of this
>>> kind are expected to be found in the esp module. As mentioned
>>> previously, I recommend keeping the mitigation in place for the time
>>> being.
>>
>> As a maybe better mitigation, can we somehow make in-place / zero-copy
>> runtime configurable, and not only for esp?
>
> A generic mechanism would require careful trade-off analysis, and I
> don't yet have a good idea for it.
>
> That said, at least for the networking stack, it looks likely that
> the root cause will be addressed going forward:
> https://lore.kernel.org/all/20260514163802.1d49d7cb@kernel.org/
What about netfilter? That can also mutate packets. Does it always copy?
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
