3 ms·
> To trigger the vulnerable code path, an application on the target must be bound to a raw socket. What is a "raw socket" in this context?
by zorlack 4y ago
> To trigger the vulnerable code path, an application on the target must be bound to a raw socket.
What is a "raw socket" in this context?
- MadsRC 4y agoThings like wireshark binds to a raw socket rather than using the Windows API
- Someone1234 4y agoThe sockets API is a Windows API, and Wireshark does not use it. Instead it uses Npcap, a custom kernel driver. A raw socket allows creation/consumption of bespoke packet types (i.e. not Tcp/Udp). In this case ICMP.
- dboreham 4y agoRaw is a protocol type in the socket api allowing the application to send and receive arbitrary packets (e.g. not packets generated by the system's TCP implementation).
- Noxwizard 4y agoThis means the listening socket was created using SOCK_RAW as opposed to SOCK_STREAM or SOCK_DGRAM. Raw sockets are used for working with ICMP, doing packet sniffing, sending some types of custom TCP packets, etc. Basically anything that isn't UDP or TCP, you'll need a raw socket for.
- cryptonector 4y agoHistorically programs like `ping` and `traceroute` use raw sockets. Using raw sockets requires privilege, which is why those historically have been set-uid on Unix systems.
- Noxwizard 4y agoIndeed. Windows requires elevation for raw sockets as well. The ping binary works without elevation by using the IP Helper Win32 API's ICMP functions: https://learn.microsoft.com/en-us/windows/win32/api/icmpapi/nf-icmpapi-icmpsendecho2ex https://learn.microsoft.com/en-us/windows/win32/api/icmpapi/...
- drewcoo 4y agohttps://learn.microsoft.com/en-us/windows/win32/winsock/service-provided-raw-sockets-2 https://learn.microsoft.com/en-us/windows/win32/winsock/serv... And here they explain that if you use SOCK_RAW, you should look out for bad datagrams: https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2 https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-...
- cryptonector 4y agoSo is this a vulnerability in specific raw sockets applications (i.e., you could get it right in the application), or a vulnerability in the Windows kernel's TCP/IP stack that is only exploitable when there is a raw sockets application running?