Messages in this thread |  | | Date | Tue, 12 Mar 2024 10:45:28 +0100 | | From | Michal Hocko <> | | Subject | Re: CVE-2023-52596: sysctl: Fix out of bounds access for empty sysctl registers |
| |
On Tue 12-03-24 09:17:30, Lee Jones wrote: [...] > > Backporting this is fine, but wouldn't fix an issue unless an external > > module had empty sysctls. And exploiting this is not possible unless > > you purposely build an external module which could end up with empty > > sysctls.
Thanks for the clarification Luis!
> Thanks for the amazing explanation Luis. > > If I'm reading this correctly, an issue does exist, but an attacker > would have to lay some foundations before it could be triggered. Sounds > like loading of a malicious or naive module would be enough.
If the bar is set as high as a kernel module to create and empty sysctl directory then I think it is safe to say that the security aspect is mostly moot. There are much simpler ways to attack the system if you are able to load a kernel module.
> We know from conducting postmortems on previous exploits that successful > attacks often consist of leveraging a chain of smaller, seemingly > implausible or innocuous looking bugs rather than in isolation. > > With that in mind, it is still my belief that this could be used by an > attacker in such a chain. Unless I have this totally wrong or any of > the maintainers have strong feelings to the contrary, I would like to > keep the CVE number associated with this fix.
No, no real strong feelings but I have to say that I find a CVE more than a stretch. Kernel modules could do much more harm than just abuse this particular bug. -- Michal Hocko SUSE Labs
|  |