From: Florian Westphal <fw@strlen.de>
To: ye.xingchen@zte.com.cn
Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, corbet@lwn.net, dsahern@kernel.org,
ncardwell@google.com, soheil@google.com, haiyangz@microsoft.com,
lixiaoyan@google.com, mfreemon@cloudflare.com,
david.laight@aculab.com, netdev@vger.kernel.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
fan.yu9@zte.com.cn, he.peilin@zte.com.cn, xu.xin16@zte.com.cn,
yang.yang29@zte.com.cn, yang.guang5@zte.com.cn,
zhang.yunkai@zte.com.cn
Subject: Re: [PATCH net-next v2] icmp: Add icmp_timestamp_ignore_all to control ICMP_TIMESTAMP
Date: Tue, 21 May 2024 11:25:02 +0200 [thread overview]
Message-ID: <20240521092502.GB2980@breakpoint.cc> (raw)
In-Reply-To: <20240520165335899feIJEvG6iuT4f7FBU6ctk@zte.com.cn>
ye.xingchen@zte.com.cn <ye.xingchen@zte.com.cn> wrote:
> From: YeXingchen <ye.xingchen@zte.com.cn>
>
> The CVE-1999-0524 vulnerability is associated with ICMP
> timestamp messages, which can be exploited to conduct
> a denial-of-service (DoS) attack. In the Vulnerability
> Priority Rating (VPR) system, this vulnerability was
> rated as a medium risk in May of this year.
> Link:https://www.tenable.com/plugins/nessus/10113
Please explain at least one scenario where this is a problem.
AFAICS there is none and Linux is not affected by this.
> To protect embedded systems that cannot run firewalls
> from attacks exploiting the CVE-1999-0524 vulnerability,
> the icmp_timestamp_ignore_all sysctl is offered as
If there is an actual problem, then this should be on by default
or the entire feature should be removed.
But I don't think there is a problem in the first place.
prev parent reply other threads:[~2024-05-21 9:26 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-20 8:53 [PATCH net-next v2] icmp: Add icmp_timestamp_ignore_all to control ICMP_TIMESTAMP ye.xingchen
2024-05-21 8:57 ` Paolo Abeni
2024-05-21 9:25 ` Florian Westphal [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240521092502.GB2980@breakpoint.cc \
--to=fw@strlen.de \
--cc=corbet@lwn.net \
--cc=davem@davemloft.net \
--cc=david.laight@aculab.com \
--cc=dsahern@kernel.org \
--cc=edumazet@google.com \
--cc=fan.yu9@zte.com.cn \
--cc=haiyangz@microsoft.com \
--cc=he.peilin@zte.com.cn \
--cc=kuba@kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lixiaoyan@google.com \
--cc=mfreemon@cloudflare.com \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=soheil@google.com \
--cc=xu.xin16@zte.com.cn \
--cc=yang.guang5@zte.com.cn \
--cc=yang.yang29@zte.com.cn \
--cc=ye.xingchen@zte.com.cn \
--cc=zhang.yunkai@zte.com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).