netdev - Re: possible proble with skb_pull() in smsc75xx_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 Nov 2023 13:35:14 +0100
From: Oliver Neukum <oneukum@...e.com>
To: Szymon Heidrich <szymon.heidrich@...il.com>,
 Oliver Neukum <oneukum@...e.com>
Cc: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
 USB list <linux-usb@...r.kernel.org>
Subject: Re: possible proble with skb_pull() in smsc75xx_rx_fixup()

On 16.11.23 21:09, Szymon Heidrich wrote:
> Hello Oliver,
> 
> Could you please give me some hints how this could be practically exploited to cause mischief?

Hi,

it seems to me like you can easily feed stuff that is not
part of a packet into the network layer, but you cannot overflow the buffer.
In other words, the issue exists, but using it to do harm is hard.

	Regards
		Oliver