BUG: minor net namespace information leakage of packet socket via /proc/net/ptype

From: Liu, Congyu <hidden>
Date: 2022-01-13 04:59:31

Hello,

In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. I believe this is related to net namespace information leakage because packet socket is net namespace aware and its `packet_type` information should not be leaked.

The root cause is that function `net/core/net-procfs.c:ptype_seq_show` only checks the net namespace of `pt->dev`. It allows the `packet_type` to be shown when `pt->dev` is NULL, but does not check the net namespace of corresponding packet socket.

I am very willing to work on a patch if this is confirmed as a bug, though I haven't figured out a clean way to retrieve the net namespace of corresponding packet socket via `packet_type` structure. It would be great if you could provide some feedback. Thank you!

Thanks,
Congyu
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help