netdev - BUG: minor net namespace information leakage of packet socket via /proc/net/ptype

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <MWHPR2201MB10726FB1BD0E3B8735AD8DB1D0539@MWHPR2201MB1072.namprd22.prod.outlook.com>
Date:   Thu, 13 Jan 2022 04:59:23 +0000
From:   "Liu, Congyu" <liu3101@...due.edu>
To:     "xemul@...nvz.org" <xemul@...nvz.org>,
        "xiyou.wangcong@...il.com" <xiyou.wangcong@...il.com>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: BUG: minor net namespace information leakage of packet socket via
 /proc/net/ptype

Hello,

In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. I believe this is related to net namespace information leakage because packet socket is net namespace aware and its `packet_type` information should not be leaked.

The root cause is that function `net/core/net-procfs.c:ptype_seq_show` only checks the net namespace of `pt->dev`. It allows the `packet_type` to be shown when `pt->dev` is NULL, but does not check the net namespace of corresponding packet socket.

I am very willing to work on a patch if this is confirmed as a bug, though I haven't figured out a clean way to retrieve the net namespace of corresponding packet socket via `packet_type` structure. It would be great if you could provide some feedback. Thank you!

Thanks,
Congyu