linux-kernel - Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 13 Jul 2017 00:19:35 +0200
From:   Florian Westphal <fw@...len.de>
To:     Richard Weinberger <richard@....at>
Cc:     Florian Westphal <fw@...len.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        David Miller <davem@...emloft.net>,
        netfilter-devel@...r.kernel.org, coreteam@...filter.org,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        David Gstir <david@...ma-star.at>, kaber@...sh.net,
        "keescook@...omium.org" <keescook@...omium.org>
Subject: Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID

Richard Weinberger <richard@....at> wrote:
> Am 01.07.2017 um 12:35 schrieb Florian Westphal:
> > The compare on removal is not needed afaics, and its also not used when
> > doing lookup to begin with, so we can just recompute it?
> 
> Isn't this a way too much overhead?

I don't think so.  This computation only occurs when we dump events
to userspace.

> I personally favor Pablo's per-cpu counter approach.
> That way the IDs are unique again and we get rid of the info leak without
> much effort.

I have not seen these patches so can't really comment.