Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Richard Weinberger <richard@xxxxxx> wrote:
> Florian,
> 
> Am 30.06.2017 um 21:35 schrieb Florian Westphal:
> > Richard Weinberger <richard@xxxxxx> wrote:
> >> Hi!
> >>
> >> I noticed that nf_conntrack leaks kernel addresses, it uses the memory address
> >> as identifier used for generating conntrack and expect ids..
> >> Since these ids are also visible to unprivileged users via network namespaces
> >> I suggest reverting these commits:
> > 
> > Why not use a hash of the address?
> 
> Would also work. Or xor it with a random number.
> 
> On the other hand, for user space it would be more useful when the conntrack id
> does not repeat that often. That's why I favor the good old counter method.
> Currently the conntrack id is reused very fast.
> e.g. in one of our applications we use the conntack id via NFQUEUE and watch the
> destroy events via conntrack. It happens regularly that a new connection has the
> same id than a different connection we saw some moments before, before we receive
> the destroy event from the conntrack socket.

Perhaps we can place that in a new extension (its not needed in any
fastpath ops)?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux