Udp.c in Linux kernel pre-4.5 allows remote attackers to execute arbitrary code

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by vbernat on Thursday April 13, 2017 @08:19AM (#14106141)

This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by mhei on Thursday April 13, 2017 @09:48AM (#14106833)

The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare:

http://lxr.free-electrons.com/source/net/core/datagram.c?v=3...

http://lxr.free-electrons.com/source/net/core/datagram.c?v=4...

I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that?

EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by vbernat on Thursday April 13, 2017 @11:01AM (#14107521)

Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by trebla on Thursday April 13, 2017 @09:02AM (#14106424)

Is it confirmed that kernels before 3.19 are safe?

[ Parent | on HN ]