[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20210817180250.qm2d6wicxwjif3jq@yuggoth.org>
Date: Tue, 17 Aug 2021 18:02:51 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: [OSSA-2021-004] Neutron: Linuxbridge ARP filter
bypass on Netfilter platforms (CVE-2021-38598)
On 2021-08-17 19:30:21 +0200 (+0200), Jan Engelhardt wrote:
>
> On Tuesday 2021-08-17 17:17, Jeremy Stanley wrote:
> >Description
> >~~~~~~~~~~~
> >Jake Yip with ARDC and Justin Mammarella with the University of
> >Melbourne reported a vulnerability in Neutron's linuxbridge driver
> >on newer Netfilter-based platforms (the successor to IPTables).
>
> ip_tables is running atop the netfilter API, so.... it's
> not an ordered set with predecessors and successors.
Yes, thanks. It would have been more accurate to draw the comparison
between ebtables and ebtables-nft, which is where the underlying
problem arises. I was trying not to get too into the weeds with
technical detail for the general user audience, who may not be
particularly aware of the names for layer 2 filtering mechanisms,
but I agree this wording is also mildly misleading as a result.
Should I have said "Netfilter-based platforms (the successor to
legacy IPTables)" instead, to differentiate it from Netfilter-based
IPTables?
--
Jeremy Stanley
Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
