netdev - Re: Race Condition Vulnerability in atalk_bind of appletalk module leading to UAF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <97105910-1cee-e171-4d63-04c21e6b549d@kernel.org>
Date: Sun, 8 Oct 2023 21:16:40 -0600
From: David Ahern <dsahern@...nel.org>
To: Willy Tarreau <w@....eu>, Stephen Hemminger <stephen@...workplumber.org>
Cc: netdev@...r.kernel.org, rootlab@...wei.com
Subject: Re: Race Condition Vulnerability in atalk_bind of appletalk module
 leading to UAF

On 10/7/23 10:42 AM, Willy Tarreau wrote:
> On Sat, Oct 07, 2023 at 08:57:35AM -0700, Stephen Hemminger wrote:
>> On Sat, 7 Oct 2023 08:35:12 +0200
>> Willy Tarreau <w@....eu> wrote:
>>
>>> Hello,
>>>
>>> Sili Luo of Huawei sent this to the security list. Eric and I think it
>>> does not deserve special handling from the security team and will be
>>> better addressed here.
>>>
>>> Regards,
>>> Willy
>>>
>>> PS: there are 6 reports for atalk in this series.
>>
>> Maybe time has come to kill Appletalk like DecNet was removed?

+1

> 
> This long painful series could definitely be the best argument for this,
> as I doubt anyone still relies on it so much that they're willing to
> invest several hours to fix this mess!

and if that were to happen, whoever it is can always start with a revert
of the removal patch and then fix known problems to get it added back to
the code base.

Seems like the right thing to do is remove it.