Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <95ddd38e-2e23-4dee-b03c-a376d8cb9814@gmail.com>
Date: Tue, 29 Oct 2024 21:09:01 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2024-36905: Linux kernel: Divide-by-zero on
 shutdown of TCP_SYN_RECV sockets

On 10/29/24 08:03, Joel GUITTET wrote:
> We would like to ask your advice about the CVE-2024-36905 (tcp shutdown vulnerability).
> NIST indicates a network vector while AWS and Red Hat indicates local attack vector.
> Our cybersecurity team has difficulties to justify that a local vector is appropriate here.
> Can you help us to understand this specific point for this CVE ? The hypothesis we have is that a TCP socket need to be open/closed quickly, and maybe it's not possible remotely ?

 From my understanding of Git commit 
94062790aedb505bdda209b10bea47b294d6394f 
(<URL:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=94062790aedb505bdda209b10bea47b294d6394f>), 
this appears to be a race condition where a program (running locally) 
calls connect(2) and then shutdown(2) without actually attempting to 
transfer any data, with a further constraint that certain packets (I am 
unsure precisely what) must have been transferred such that the TCP 
connection is half-opened.  It *might* be possible to cause this crash 
remotely if a program attempts to set up a unidirectional TCP connection 
(achieved by shutting down the undesired direction) but I am unsure if 
any such programs are actually in use.

I would need to further study the Linux networking code to be sure, but 
a comment updated in the patch seems to imply that this is an edge case 
that was previously believed to be impossible to reach.  I suspect NIST 
labeled it "network" because TCP is involved, but as of this writing 
<URL:https://nvd.nist.gov/vuln/detail/CVE-2024-36905> says "This 
vulnerability is currently awaiting analysis." so I would expect NIST's 
indication to be revised after that analysis is completed.

Again, this issue is probably only remotely exploitable if the host is 
running a very unusual client program, but a local exploit can supply 
the required oddly-behaving program.


-- Jacob

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.