Re: New Linux kernel NetFilter flaw gives attackers root privileges

[Solar Designer <solar () openwall com>]

On Wed, May 10, 2023 at 08:02:49PM +0100, Piotr Krysiuk wrote:
> On Wed, May 10, 2023 at 5:55???PM Solar Designer <solar () openwall com> wrote:
> > Is the netfilter issue really worse than the io_uring issue?  I doubt
> > it.  So _maybe_ it was something in the wording that tripped someone
> > writing for one of those tech news websites, then others picked it up?

When writing the above, I didn't recall that the io_uring issue is
6.3-only, which does make it relatively less important.

Brad Spengler reminded me of this aspect on Twitter.  Thanks.

> I suspect that what triggered the media is the following fragment:
>
> > Somebody from the Linux kernel team then emailed the proposed fix to
> > <linux-distros ()    openwall org> and that email also included a link to
> > download our description of exploitation techniques and our exploit
> > source code.
> >
> > Therefore, according to the linux-distros list policy, the exploit must
> > be published within 7 days from this advisory.

Oh, that could have looked like drama.  Yes, that could be it.

> So in the advisory I wanted to explain the reason why the exploit must
> be posted, given that was not my original plan.

Sure.  I think this is good for transparency.

> > As expected.  Now, from a typical distro user's standpoint,
> > "unprivileged local users" may be just right.  However, not all distros
> > have unprivileged user namespaces enabled by default.
>
> You are right, I should have explained the dependencies. Do you think
> it would be OK to include the correction on Monday? Or is it better to
> send today (it may catch even more media)? I will make sure to review
> the wording with you before posting.

We're already having this very discussion on the list, just not in the
same thread... and I just realized that maybe you didn't realize that.

When you post the exploitation techniques and the exploit code on
Monday, please do explain the dependencies in that same message.

Thanks,

Alexander