[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <95ddd38e-2e23-4dee-b03c-a376d8cb9814@gmail.com>
Date: Tue, 29 Oct 2024 21:09:01 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2024-36905: Linux kernel: Divide-by-zero on
shutdown of TCP_SYN_RECV sockets
On 10/29/24 08:03, Joel GUITTET wrote:
> We would like to ask your advice about the CVE-2024-36905 (tcp shutdown vulnerability).
> NIST indicates a network vector while AWS and Red Hat indicates local attack vector.
> Our cybersecurity team has difficulties to justify that a local vector is appropriate here.
> Can you help us to understand this specific point for this CVE ? The hypothesis we have is that a TCP socket need to be open/closed quickly, and maybe it's not possible remotely ?
From my understanding of Git commit
94062790aedb505bdda209b10bea47b294d6394f
(<URL:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=94062790aedb505bdda209b10bea47b294d6394f>),
this appears to be a race condition where a program (running locally)
calls connect(2) and then shutdown(2) without actually attempting to
transfer any data, with a further constraint that certain packets (I am
unsure precisely what) must have been transferred such that the TCP
connection is half-opened. It *might* be possible to cause this crash
remotely if a program attempts to set up a unidirectional TCP connection
(achieved by shutting down the undesired direction) but I am unsure if
any such programs are actually in use.
I would need to further study the Linux networking code to be sure, but
a comment updated in the patch seems to imply that this is an edge case
that was previously believed to be impossible to reach. I suspect NIST
labeled it "network" because TCP is involved, but as of this writing
<URL:https://nvd.nist.gov/vuln/detail/CVE-2024-36905> says "This
vulnerability is currently awaiting analysis." so I would expect NIST's
indication to be revised after that analysis is completed.
Again, this issue is probably only remotely exploitable if the host is
running a very unusual client program, but a local exploit can supply
the required oddly-behaving program.
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
