Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

Message-ID:
 <AM9P192MB131684EA6145690A492F481FD7682@AM9P192MB1316.EURP192.PROD.OUTLOOK.COM>
Date: Tue, 24 Sep 2024 09:12:46 +0000
From: Joel GUITTET <jguittet@...ekio.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2024-42154: Linux kernel: tcp_metrics: validate source addr length

Hello security team!

I'm working on a medical product actually and have trouble about the CVE-2024-42154. It is regarding NETLINK socket which can be used only locally, but it is classified with "NETWORK" flag. NETWORK flag is annoying because it means more difficult to justify the CVE.

I already ask the NIST why the NETWOKR flag was set for this CVE, they answer me that it's linked to socket and without more public reference they are just setting the NETWORK flag, in case of.

Can I ask you your opinion about this CVE and the pertinence of the NETWORK flag here?

Thanks for any feedback,
Regard
Joel





Witekio France is an SAS company registered in Lyon. Registered office: 14 rue Rhin et Danube - 69009 Lyon. Registered company number: RCS 518 864 012 00035. VAT number FR 68 518 864 012
This message contains confidential information and is intended only for the individual(s) addressed in the message. If you aren't the named addressee, you should not disseminate, distribute, or copy this e-mail.

We continuously commit to comply with the applicable data protection laws and ensure fair and transparent processing of your personal data. Please read our privacy statement including an information notice and data protection policy for detailed information on our website.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.