linux-kernel - Re: [PATCH 0/2] tun/tap: set sk_uid from current

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230803094343.698b3c34@kernel.org>
Date:   Thu, 3 Aug 2023 09:43:43 -0700
From:   Jakub Kicinski <kuba@...nel.org>
To:     Laszlo Ersek <lersek@...hat.com>
Cc:     linux-kernel@...r.kernel.org, Eric Dumazet <edumazet@...gle.com>,
        Lorenzo Colitti <lorenzo@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>,
        Pietro Borrello <borrello@...g.uniroma1.it>,
        netdev@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH 0/2] tun/tap: set sk_uid from current_fsuid()

On Mon, 31 Jul 2023 18:42:35 +0200 Laszlo Ersek wrote:
> The original patches fixing CVE-2023-1076 are incorrect in my opinion.
> This small series fixes them up; see the individual commit messages for
> explanation.
> 
> I have a very elaborate test procedure demonstrating the problem for
> both tun and tap; it involves libvirt, qemu, and "crash". I can share
> that procedure if necessary, but it's indeed quite long (I wrote it
> originally for our QE team).
> 
> The patches in this series are supposed to "re-fix" CVE-2023-1076; given
> that said CVE is classified as Low Impact (CVSSv3=5.5), I'm posting this
> publicly, and not suggesting any embargo. Red Hat Product Security may
> assign a new CVE number later.
> 
> I've tested the patches on top of v6.5-rc4, with "crash" built at commit
> c74f375e0ef7.

FTR this was applied yesterday to net. Thanks!