Yikes! Linux Kernel remote code exec via double UDP cksum calculation (triggered by MSG_PEEK). NEEDS BRANDING! ;P https://nvd.nist.gov/vuln/detail/CVE-2016-10229 …
-
-
As a user (with a rooted device) you can mitigate it via iptables DROP of udp except localhost:53 and running local dns proxy, I think.
-
Maybe there's also a way to make iptables check the cksum b4 the pkt reaches the affected layer? IMO it's an idiotic bug that Linux doesn't.
-
ZOMG speed! I need 100 Gbit/sec of UDP packets! Let's defer checksum! - said nobody, ever.
-
hey now, why are you trying to apply logic to Linux?
-
Not so much logic as harsh criticism of idiotic tradeoffs.
-
There used to be a bug around this same deferral whereby poll/select returned readable, then recv blocked because checksum failed.
-
For years, maybe a decade, it was
@ewontfix'd. -
All of Linux networking is a mess. From API to implementation. I wouldn't be surprised if more bugs like that and CVE-2016-10229 exist.
End of conversation
New conversation -
-
-
Define trivial.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Holy crap!
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.