Re: [PATCH net] ipv6: sctp: clone options to avoid use after free

[Daniel Borkmann]

On 12/09/2015 06:11 PM, Marcelo Ricardo Leitner wrote:
> Em 09-12-2015 14:31, David Laight escreveu:
> > From: Eric Dumazet [mailto:eric.dumazet@xxxxxxxxx]
> > > Sent: 09 December 2015 16:00
> > > On Wed, 2015-12-09 at 15:49 +0000, David Laight wrote:
> > > > > SCTP is lacking proper np->opt cloning at accept() time.
> > > > >
> > > > > TCP and DCCP use ipv6_dup_options() helper, do the same in SCTP.
> > > > >
> > > > > We might later factorize this code in a common helper to avoid
> > > > > future mistakes.
> > > >
> > > > I'm wondering what the real impact of this and the other recent
> > > > SCTP bugs/patches is on real workloads?
> > > > We have enough trouble getting our customers to use kernels
> > > > later that the 2.6.18 based RHEL5 - without having to persuade
> > > > them to use kernels that contain very recent fixes.
> > >
> > > It all depends if your customers let (hostile ?) people run programs on
> > > the boxes.
> >
> > If they require hostile programs I'm not worried.
>
> Not really "require", but "allow", as in: allowing third-party applications to run on it.

Yeah :/ given distros enable almost everything anyway, the first unpriv'ed
socket(..., IPPROTO_SCTP) call auto-loads SCTP module. But to be honest, I'd
be surprised if Cloud providers allow for this. Most of this might only run
on dedicated boxes with telco appliances.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/