oss-security - Re: libmnl: incorrect validation of netlink message origin allows attackers to spoof netlink messages

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150222185410.GA10851@pisco.westfalen.local>
Date: Sun, 22 Feb 2015 19:54:10 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Assign a CVE Identifier <cve-assign@...re.org>
Subject: Re: libmnl: incorrect validation of netlink message
 origin allows attackers to spoof netlink messages

On Tue, Feb 10, 2015 at 12:13:50PM +0100, Florian Weimer wrote:
> On 02/07/2015 12:40 AM, Kurt Seifried wrote:
> > https://bugzilla.redhat.com/show_bug.cgi?id=848949
> > 
> > this may warrant a cve
> 
> It was blamed on the kernel and fixed there:
> 
>   <http://marc.info/?l=linux-netdev&m=134582981424588>

MITRE, can you please assign a CVE ID for the kernel, then?

This was fixed in 3.6 with
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=20e1db19db5d6b9e4e83021595eab0dc8f107be\f

Cheers,
        Moritz

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.