MSG_PEEK is pretty common, CVE-2016-10229 is worse than you think April 13, 2017 on Drew DeVault's blog

I heard about CVE-2016-10229 earlier today. In a nutshell, it allows for arbitrary code execution via UDP traffic if userspace programs are using MSG_PEEK in their recv calls. I quickly updated my kernels and rebooted any boxes where necessary, but when I read the discussions on this matter I saw people downplaying this issue by claiming MSG_PEEK is an obscure feature.

I don’t want to be a fear monger and I’m by no means a security expert but I suspect that this is a deeply incorrect conclusion. If I understand this vulnerability right you need to drop everything and update any servers running a kernel <4.5 immediately. MSG_PEEK allows a programmer using UDP to read from the kernel’s UDP buffer without consuming the data (so subsequent reads will continue to read the same data). This immediately sounds to me like a pretty useful feature that a lot of software might use, not an obscure one.

I did quick search for software where MSG_PEEK appears in the source code somewhere. This does not necessarily mean that it’s exploitable, but should certainly raise red flags. Here’s a list of some notable software I found:

I also found a few things like programming languages and networking libraries that you might expect to have MSG_PEEK if only to provide that functionality to programmers leveraging them. I didn’t investigate too deeply into whether or not that was the case or if this software is using the feature in a less apparent way, but in this category I found Python, Ruby, Node.js, smalltalk, octave, libnl, and socat. I used searchcode.com to find these - here’s the full search results.

Again, I’m not a security expert, but I’m definitely spooked enough to update my shit and I suggest you do so as well. Red Hat, Debian, and Ubuntu are all unaffected because of the kernel they ship. Note, however, that many cloud providers do not let you choose your own kernel. This could mean that you are affected even if you’re running a distribution like Debian. Double check it - use uname -r and update+reboot if necessary.

Have a comment on one of my posts? Start a discussion in my public inbox by sending an email to ~sircmpwn/public-inbox@lists.sr.ht [mailing list etiquette]

Articles from blogs I read Generated by openring

Announcing the 2020 Go Developer Survey

Help shape the future of Go Since 2016, thousands of Gophers around the world have helped the Go project by sharing their thoughts via our annual Go Developer Survey. Your feedback has played an enormous role in driving changes to our langu…

via The Go Programming Language Blog October 20, 2020

Status update, October 2020

Hi all, it’s been a while! I’ve been taking some time off this month: I’ve been hiking in Corsica (an island in the south of France) for 2 weeks! The path (called GR20) was very difficult but the gorgeous landscapes made it entirely worth it. :) I’ve uploaded…

via emersion October 16, 2020

What's cooking on Sourcehut? October 2020

Once again we meet to discuss the status of the ongoing SourceHut alpha, which has made progress by leaps and bounds this month. We’re joined by 521 new users this month, bringing our total up to 17,715. As always, please welcome them warmly and show our new…

via Blogs on Sourcehut October 15, 2020