[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20241112145853.GA6243@openwall.com>
Date: Tue, 12 Nov 2024 15:58:53 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets
On Tue, Oct 29, 2024 at 09:09:01PM -0500, Jacob Bachmeyer wrote:
> On 10/29/24 08:03, Joel GUITTET wrote:
> >We would like to ask your advice about the CVE-2024-36905 (tcp shutdown
> >vulnerability).
> >NIST indicates a network vector while AWS and Red Hat indicates local
> >attack vector.
> >Our cybersecurity team has difficulties to justify that a local vector is
> >appropriate here.
> >Can you help us to understand this specific point for this CVE ? The
> >hypothesis we have is that a TCP socket need to be open/closed quickly,
> >and maybe it's not possible remotely ?
>
> From my understanding of Git commit
> 94062790aedb505bdda209b10bea47b294d6394f
> (<URL:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=94062790aedb505bdda209b10bea47b294d6394f>),
> this appears to be a race condition where a program (running locally) calls
> connect(2) and then shutdown(2) without actually attempting to transfer any
> data, with a further constraint that certain packets (I am unsure precisely
> what) must have been transferred such that the TCP connection is
> half-opened. It *might* be possible to cause this crash remotely if a
> program attempts to set up a unidirectional TCP connection (achieved by
> shutting down the undesired direction) but I am unsure if any such programs
> are actually in use.
>
> I would need to further study the Linux networking code to be sure, but
> a comment updated in the patch seems to imply that this is an edge case
> that was previously believed to be impossible to reach. I suspect NIST
> labeled it "network" because TCP is involved, but as of this writing
> <URL:https://nvd.nist.gov/vuln/detail/CVE-2024-36905> says "This
> vulnerability is currently awaiting analysis." so I would expect NIST's
> indication to be revised after that analysis is completed.
NIST doesn't appear to provide their own CVSS vectors/scores lately.
However, they republish (with attribution) some third-party ones, this
time from CISA-ADP. The CISA-ADP CVSS vector for this vulnerability
specifies that it not only is network-reachable, but also that it has
High impact not only on Availability, but also on Confidentiality and
Integrity. This results in a CVSSv3.1 score of 9.8. Even merely
correcting the vector not to claim any Confidentiality and Integrity
impact (as a divide-by-zero generally does not have that) would bring
the score down significantly.
So a question for this list/thread may be - where/how may we dispute
CISA-ADP analysis? Maybe someone would reply with specific contact info
for them, and Joel would proceed with that.
Also, this bug existed since prehistoric times. The commit referenced
above says:
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
This is git commit from 2005, which says "Initial git repository build."
If the issue were in fact network-reachable with low access complexity
and no user interaction required (as the CISA-ADP CVSS vector claims),
then we'd have had plenty of Linux systems on the Internet crashing with
divide-by-zero in the kernel very often. Since we didn't notice that,
and since the bug doesn't involve e.g. any magic numbers, this disproves
that it's easily triggerable over network in typical setups.
> Again, this issue is probably only remotely exploitable if the host is
> running a very unusual client program, but a local exploit can supply
> the required oddly-behaving program.
Joel wasn't subscribed to oss-security at the time, but has since
subscribed and wanted to post a follow-up question, which I am doing to
add it to the thread:
"Thanks for your reply Jacob.
Anyone able to comment about Red Hat or AWS justifications on this CVE ?"
To me, the above is already that kind of comment, but perhaps Joel would
like to hear specifically from Red Hat and AWS.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
