[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <173ce2fa-fe90-4e00-e5a3-1f3163dfe13d@hartkopp.net>
Date: Fri, 28 May 2021 17:41:03 +0200
From: Oliver Hartkopp <socketcan@...tkopp.net>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: mkl@...gutronix.de, alex.popov@...ux.com, seth.arnold@...onical.com,
steve.beattie@...onical.com, cascardo@...onical.com,
oss-security@...ts.openwall.com, Norbert Slusarek <nslusarek@....net>,
"David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
security@...nel.org
Subject: Re: Linux kernel: net/can/isotp: race condition leads to local
privilege escalation
Hello Greg,
this patch ("can: isotp: prevent race between isotp_bind() and
isotp_setsockopt()") has hit Linus' tree ~36h ago:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/can?id=2b17c400aeb44daf041627722581ade527bb3c1d
It has a CVE number and is potentially exploitable - but it was not in
the latest batch of stable kernels about ~4h ago.
It was obviously not tagged properly for stable kernels but has a fixes-tag:
Fixes: 921ca574cd38 ("can: isotp: add SF_BROADCAST support for
functional addressing")
which was introduced in 5.11
Thanks for taking care!
Best,
Oliver
On 14.05.21 01:52, Norbert Slusarek wrote:
> As Salvatore already mentioned, the assigned CVE ID is CVE-2021-32606.
> The exploitation details are published in an article available on github
> via this link:
> https://git.io/JsYYB
> <https://deref-gmx.net/mail/client/ulc_0Gq1TD4/dereferrer/?redirectUrl=https%3A%2F%2Fgit.io%2FJsYYB>
>
> Regards,
> Norbert Slusarek
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
