oss-sec mailing list archives
Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit
From: Evgenii Shatokhin <eshatokhin () virtuozzo com>
Date: Fri, 25 May 2018 15:04:15 +0300
On 25.05.2018 13:48, Andrey Konovalov wrote:
On Wed, May 23, 2018 at 4:57 PM, Kurt Seifried <kseifried () redhat com> wrote:On Wed, May 23, 2018 at 8:49 AM, Andrey Konovalov <andreyknvl () gmail com> wrote:On Thu, May 10, 2018 at 2:05 PM, Vladis Dronov <vdronov () redhat com> wrote:Hello, A null pointer dereference in dccp_write_xmit() function innet/dccp/output.cin the Linux kernel before v4.16-rc7 allows a local user to cause adenial ofservice by a number of certain crafted system calls.So the classic CVE statement for this is "does it cross/violate a trust boundary". Yeah I know, not super helpful. In general when I look at something and need to decide whether or not it deserves/needs a CVE the fundamentals are: 1) Can an attacker use this vulnerability to gain access, additional privileges, basically is there an impact to Confidentiality/Availability/Integrity? This is really two tests: is there an impact, and is there a way for the attacker to trigger or exploit it? That's a CVE. 2) Does the software/system make a specific security claim that they then fail to meet? E.g. "we include a firewall that blocks access to everything inbound except for port 22", if they were to then also allow port 80, that'd be a CVE. So for the syzbot stuff mostly what you need to determine is: a) is there a security related impact? AND b) can an attacker trigger it? If both are yes, then a CVE is warranted.Hi Kurt, Perhaps I should've been more clear. I wasn't asking "what qualifies for a CVE?", but rather "There are a 100 bugs that qualify for CVEs, how do single out 10 of them to actually request CVEs for?". In particular, the 100 bugs that I'm referring to are the bugs reported by syzbot (perhaps there's even more: https://syzkaller.appspot.com/?fixed=upstream) and the 10 bugs (or so) are the ones Vladis announced on oss-security over the last few months. I'm just curious how did he choose those 10 bugs out of that 100+.
If I understand it correctly, Syzkaller programs run as root. Therefore, it is still needed to check which of the bugs it has found are security flaws.
As for this particular bug in dccp_write_xmit() - I stumbled upon that Syzbot's report and checked that the bug was exploitable by an unprivileged user if dccp modules were loaded. Then I reported the problem to RedHat, and they desided to request a CVE for that. The problem is not critical for RHEL, by the way, but still.
I don't know, if the process was the same for other bugs found by Syzkaller they requested CVEs for.
Regards, Evgenii
Thanks! .
Current thread:
- CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Vladis Dronov (May 10)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Andrey Konovalov (May 23)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Kurt Seifried (May 23)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Andrey Konovalov (May 25)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Evgenii Shatokhin (May 25)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Andrey Konovalov (May 25)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Kurt Seifried (May 25)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Andrey Konovalov (May 25)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Kurt Seifried (May 23)
- Re: CVE-2018-1130: Linux kernel: dccp: a null pointer dereference in net/dccp/output.c:dccp_write_xmit Andrey Konovalov (May 23)