5 ms·

Commit which introduced the problem: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0abdadcc6e1 https://git.kernel.org/pub/scm/l

by okl 3y ago

Commit which introduced the problem: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0abdadcc6e1 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... The nested switch/case with return in the default path, then expecting fall-through, looks bogus to me.

rightbyte 3y ago
Same guy? https://lwn.net/Articles/882397/ https://lwn.net/Articles/882397/
- pphysch 3y ago
  > I would encourage you to read up on details of McHardy’s practices. They were clearly not done in good faith and there was no attempt to encourage compliance. The only goal was to extract as much money as possible even if the violations were more technical or incidental in nature and the companies willing to attempt remedy. Even minor and unintentional violations were pursued zealously without interest in remedy - just cash. > My understanding is he also didn’t truly prioritize deep pocketed violators (no suit against VMWare, afaik) - he prioritized that delicious sweet spot of “deep enough to pay me off, but too small to make it realistic to fight me in court”. And, again, he was uninterested in remediation of even minor and unintentional violations - he wanted cash. It seems unlikely this was helping the cause of free software. Seems entirely possible that such a character would knowingly insert a backdoor to sell as a 0-day.
  - spr-alex 3y ago
    this code was written before unprivileged network namespaces were much of a thing so the theory that a developer would plant a bugdoor for this is not probable. you can think of unprivileged namespaces in general as a bunch of attack surface that was previously root to kernel only and hadn't had much scrutiny. these bugs will take decades to eliminate without a rewrite of linux.
MuffinFlavored 3y ago
Your link converted to GitHub: https://github.com/torvalds/linux/commit/f342de4e2f33e0e39165d8639387aa6c19dff660 https://github.com/torvalds/linux/commit/f342de4e2f33e0e3916... https://bugs.launchpad.net/bugs/cve/2024-1086 https://bugs.launchpad.net/bugs/cve/2024-1086 > A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

by okl 3y ago

rightbyte 3y ago

Same guy? https://lwn.net/Articles/882397/ https://lwn.net/Articles/882397/

pphysch 3y ago
> I would encourage you to read up on details of McHardy’s practices. They were clearly not done in good faith and there was no attempt to encourage compliance. The only goal was to extract as much money as possible even if the violations were more technical or incidental in nature and the companies willing to attempt remedy. Even minor and unintentional violations were pursued zealously without interest in remedy - just cash. > My understanding is he also didn’t truly prioritize deep pocketed violators (no suit against VMWare, afaik) - he prioritized that delicious sweet spot of “deep enough to pay me off, but too small to make it realistic to fight me in court”. And, again, he was uninterested in remediation of even minor and unintentional violations - he wanted cash. It seems unlikely this was helping the cause of free software. Seems entirely possible that such a character would knowingly insert a backdoor to sell as a 0-day.
- spr-alex 3y ago
  this code was written before unprivileged network namespaces were much of a thing so the theory that a developer would plant a bugdoor for this is not probable. you can think of unprivileged namespaces in general as a bunch of attack surface that was previously root to kernel only and hadn't had much scrutiny. these bugs will take decades to eliminate without a rewrite of linux.

MuffinFlavored 3y ago

Your link converted to GitHub: https://github.com/torvalds/linux/commit/f342de4e2f33e0e39165d8639387aa6c19dff660 https://github.com/torvalds/linux/commit/f342de4e2f33e0e3916... https://bugs.launchpad.net/bugs/cve/2024-1086 https://bugs.launchpad.net/bugs/cve/2024-1086 > A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.