Re:Windows Critical ICMP Remote Code Execution Vulnerability
by Noxwizard on Monday March 20, 2023 @10:41AM
(#35232182)
This means the listening socket was created using SOCK_RAW as opposed to SOCK_STREAM or SOCK_DGRAM. Raw sockets are used for working with ICMP, doing packet sniffing, sending some types of custom TCP packets, etc. Basically anything that isn't UDP or TCP, you'll need a raw socket for.
[ Parent
| on HN ]
Re:Windows Critical ICMP Remote Code Execution Vulnerability
by cryptonector on Monday March 20, 2023 @12:48PM
(#35234466)
Historically programs like `ping` and `traceroute` use raw sockets. Using raw sockets requires privilege, which is why those historically have been set-uid on Unix systems.
Re:Windows Critical ICMP Remote Code Execution Vulnerability
by Noxwizard on Monday March 20, 2023 @04:25PM
(#35238118)
Indeed. Windows requires elevation for raw sockets as well. The ping binary works without elevation by using the IP Helper Win32 API's ICMP functions: https://learn.microsoft.com/en-us/windows/win32/api/icmpapi/...