4 ms·

Is this a remote exploit? The NIST page seems to say so.

ptrincr 8y ago
I'd like to know this too. The NIST page links to this site, which suggests no exploit is known of as yet: https://www.securityfocus.com/bid/107063/exploit https://www.securityfocus.com/bid/107063/exploit
- net4all 8y ago
  NIST: > Attack Vector (AV): Network > Attack Complexity (AC): Low SecurityFocus: > Remote: No > Local: Yes ¯\_(ツ)_/¯
  - ungamed 8y ago
    Bogus NIST.
keyme 8y ago
Looking at the reproducer (in the kernel commit message for the fix), this is a PE. Unless some software allows a remote user to control the issuing of these calls (seems unlikely).
caf 8y ago
It's local. Of course that just means you have to chain it with a browser vulnerability to make it remote.
orblivion 8y ago
I'm waiting for the day where there's one reliable place in the world where someone can look at info about a vulnerability and see very important and basic information like this. I think the interesting technical discussions for security experts get mixed in with the useful executive summary for the rest of us. Remember when Intel ME bugs started coming out and we all had to go to Hacker News and trade rumors to figure out what was really going on?
- ungamed 8y ago
  I do try to get it right or the Red Hat affected cve pages. https://access.redhat.com/security/cve/cve-2019-8912 https://access.redhat.com/security/cve/cve-2019-8912 The problem is one can only really talk about CVE's within the context of the product, perhaps a global CVE wiki /discussion page that can have edits/discussion would be a useful resource.
  - orblivion 8y ago
    > Attack Vector: Local Very good, gets right to the point. I'll try to remember this for next time, thank you. Still could be improved a lot. I was thinking of writing up a "requirements doc" at some point for what exactly I think would be useful for such things. I'm not sure I'd be so happy with a Wiki, unless it was curated by trusted people. I wouldn't want (for example) malicious people editing a serious report to say it's no big deal just to buy themselves more time to exfiltrate more data.

I'd like to know this too. The NIST page links to this site, which suggests no exploit is known of as yet: https://www.securityfocus.com/bid/107063/exploit https://www.securityfocus.com/bid/107063/exploit

net4all 8y ago
NIST: > Attack Vector (AV): Network > Attack Complexity (AC): Low SecurityFocus: > Remote: No > Local: Yes ¯\_(ツ)_/¯
- ungamed 8y ago
  Bogus NIST.

keyme 8y ago

Looking at the reproducer (in the kernel commit message for the fix), this is a PE. Unless some software allows a remote user to control the issuing of these calls (seems unlikely).

caf 8y ago

It's local. Of course that just means you have to chain it with a browser vulnerability to make it remote.

orblivion 8y ago

I'm waiting for the day where there's one reliable place in the world where someone can look at info about a vulnerability and see very important and basic information like this. I think the interesting technical discussions for security experts get mixed in with the useful executive summary for the rest of us. Remember when Intel ME bugs started coming out and we all had to go to Hacker News and trade rumors to figure out what was really going on?

ungamed 8y ago
I do try to get it right or the Red Hat affected cve pages. https://access.redhat.com/security/cve/cve-2019-8912 https://access.redhat.com/security/cve/cve-2019-8912 The problem is one can only really talk about CVE's within the context of the product, perhaps a global CVE wiki /discussion page that can have edits/discussion would be a useful resource.
- orblivion 8y ago
  > Attack Vector: Local Very good, gets right to the point. I'll try to remember this for next time, thank you. Still could be improved a lot. I was thinking of writing up a "requirements doc" at some point for what exactly I think would be useful for such things. I'm not sure I'd be so happy with a Wiki, unless it was curated by trusted people. I wouldn't want (for example) malicious people editing a serious report to say it's no big deal just to buy themselves more time to exfiltrate more data.