[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1436144163.7337.64.camel@debian.org>
Date: Mon, 06 Jul 2015 01:56:03 +0100
From: Ben Hutchings <benh@...ian.org>
To: cve-assign@...re.org, carnil@...ian.org
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request: UDP checksum DoS
On Wed, 2015-07-01 at 22:48 -0400, cve-assign@...re.org wrote:
> >
> > https://twitter.com/grsecurity/status/605854034260426753
> > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=beb39db59d14990e401e235faf66a6b9b31240b0
>
> > remote DoS via flood of UDP packets with invalid checksums
>
> It appears that you are primarily asking for a CVE ID for the issue
> involving the absence of a cond_resched call. Use CVE-2015-5364.
>
> However, the presence of "return -EAGAIN" may also have been a
> security problem in some realistic circumstances. For example, maybe
> there's an attacker who can't transmit a flood with invalid checksums,
> but can sometimes inject one packet with an invalid checksum. The
> goal of this attacker isn't to cause a system hang; the goal is to
> cause an EPOLLET epoll application to stop reading for an indefinitely
> long period of time. This scenario can't also be covered by
> CVE-2015-5364. Is it better to have no CVE ID at all, e.g., is
> udp_recvmsg/udpv6_recvmsg simply not intended to defend against this
> scenario?
It seems reasonable to assign a second CVE ID to that issue.
Ben.
--
Ben Hutchings - Debian developer, member of Linux kernel and LTS teams
Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
