CVE-2017-17712 net/ipv4/raw.c: raw_sendmsg() race condition

#######   BUG DETAILS  ############
in net/ipv4/raw.c:
static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)

{
  ...

  struct raw_frag_vec rfv;         [1]
  ...
  ...

  if (!inet->hdrincl) {           [2]

    rfv.msg = msg;
    rfv.hlen = 0;
    err = raw_probe_proto_opt(&rfv, &fl4);
    if (err)
      goto done;
  }
  ...
  ...
  if (inet->hdrincl)  [3]
    err = raw_send_hdrinc(sk, &fl4, msg, len,
              &rt, msg->msg_flags, &ipc.sockc);
   else {
    sock_tx_timestamp(sk, ipc.sockc.tsflags, &ipc.tx_flags);
    if (!ipc.addr)
      ipc.addr = fl4.daddr;
    lock_sock(sk);
    err = ip_append_data(sk, &fl4, raw_getfrag,
             &rfv, len, 0,    [4]
             &ipc, &rt, msg->msg_flags);
  ...
}

[1] rfv is not initialized and contains a pointer to a msghdr header structure.
[2], [3] There are multiple checks against inet->hdrincl without a lock.

When we achieve (by racing inet->hdrincl via setsockopt()) inet->hdrincl=1 in [1], and inet->hdrincl=0 in [2], rfv variable remains uninitialized and used in [4].
By spraying the stack with controlled user data , we can take control of msg pointer which is used later in ip_append_data().

Fixed here : https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8f659a03a0ba9289b9aeb9b4470e6fb263d6f483

The 2017 SANS Holiday Hack Challenge
https://holidayhackchallenge.com/2017/

Docker container for django development in Ubuntu 17.10 #Tutorial

https://github.com/raminfp/docker_django

Ransomware Decryption Tools Link List (in Persian)
https://cysec-co.com/ir/ransomware-decryption-tools

Code Execution Flaws Patched in Several VMware Products
http://feedproxy.google.com/~r/Securityweek/~3/RZIW08BqLtg/code-execution-flaws-patched-several-vmware-products

VMware has released patches and updates for its ESXi, vCenter Server Appliance (vCSA), Workstation and Fusion products to address a total of four vulnerabilities, including ones that can be exploited for arbitrary code execution.
read more (http://www.securityweek.com/code-execution-flaws-patched-several-vmware-products)

Code Execution Flaws Patched in Several VMware Products
http://feedproxy.google.com/~r/Securityweek/~3/RZIW08BqLtg/code-execution-flaws-patched-several-vmware-products

VMware has released patches and updates for its ESXi, vCenter Server Appliance (vCSA), Workstation and Fusion products to address a total of four vulnerabilities, including ones that can be exploited for arbitrary code execution.
read more (http://www.securityweek.com/code-execution-flaws-patched-several-vmware-products)

Trend Micro Smart Protection Server Multiple Vulnerabilities
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities

Reversing EVM bytecode with radare2 – ICO Security
https://blog.positive.com/reversing-evm-bytecode-with-radare2-ab77247e5e53