[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CA+fCnZf1bGzpUUqUWamvLwP+x=pmMmojRsn9jRma9GsHnaZhFQ@mail.gmail.com>
Date: Fri, 25 May 2018 17:07:08 +0200
From: Andrey Konovalov <andreyknvl@...il.com>
To: Evgenii Shatokhin <eshatokhin@...tuozzo.com>
Cc: oss-security@...ts.openwall.com, Vladis Dronov <vdronov@...hat.com>
Subject: Re: CVE-2018-1130: Linux kernel: dccp: a null pointer
dereference in net/dccp/output.c:dccp_write_xmit
On Fri, May 25, 2018 at 2:04 PM, Evgenii Shatokhin
<eshatokhin@...tuozzo.com> wrote:
> If I understand it correctly, Syzkaller programs run as root. Therefore, it
> is still needed to check which of the bugs it has found are security flaws.
No, syzkaller/syzbot runs programs in a user namespace, so any distro
that allows unprivileged users to create user namespaces (e.g. Ubuntu)
is vulnerable to most of the bugs syzbot finds.
But nevertheless all those bugs need to be checked whether they
actually are security flaws, and that requires quite a lot of effort.
> As for this particular bug in dccp_write_xmit() - I stumbled upon that
> Syzbot's report and checked that the bug was exploitable by an unprivileged
> user if dccp modules were loaded. Then I reported the problem to RedHat, and
> they desided to request a CVE for that. The problem is not critical for
> RHEL, by the way, but still.
>
> I don't know, if the process was the same for other bugs found by Syzkaller
> they requested CVEs for.
OK, if the process was like that for the rest of those bugs, that
explains a somewhat random selection of syzbot bugs for which CVEs
were assigned :)
Thanks!
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
