netdev - Re: [PATCH net 0/2] net: diag: fix a potential security issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20171021.121410.701233686946304734.davem@davemloft.net>
Date:   Sat, 21 Oct 2017 12:14:10 +0100 (WEST)
From:   David Miller <davem@...emloft.net>
To:     lucien.xin@...il.com
Cc:     netdev@...r.kernel.org, edumazet@...gle.com,
        marcelo.leitner@...il.com, sd@...asysnail.net
Subject: Re: [PATCH net 0/2] net: diag: fix a potential security issue

From: Xin Long <lucien.xin@...il.com>
Date: Sat, 21 Oct 2017 14:06:27 +0800

> Imagine a customer generates a sosreport on their system, and
> with that, it loads sctp module. From then on, if their firewall
> doesn't block incoming packets for sctp, they may be prone to some
> remotely triggerable issue on sctp code, without even actually using
> sctp.

Like I said, if the protocol is so unsafe, block it in the
modules.conf file.

Block all "I don't use this" protocols in netfilter.

Otherwise, like I said, any user on their system can open a socket of
the indicated protocol.

There are many options.

Furthermore, "ss" should not signal an error because the protocol
module happens to not be open yet and as I understand it this is what
your patch does since it chooses to not load the module in this
situation.