Hacker News Reader

> netfilter: nf_tables: accept QUEUE/DROP verdict parameters

> Allow userspace to specify the queue number or the errno code for QUEUE and DROP verdicts.

Yeah, but why?

If one has to ask, it's a Five Eyes plant.

Hardly. This is just a typical double free vulnerability, AKA a normal Tuesday in the C/C++ world, and which people have been exploiting in the kernel (with its complex object lifetimes and semantics) for well over 10 years now. There's no need to "plant" anything to find these.

Which makes it a fine cover!

Reply on news.ycombinator.com