[zorlack]

> To trigger the vulnerable code path, an application on the target must be bound to a raw socket.

What is a "raw socket" in this context?

[Noxwizard]

This means the listening socket was created using SOCK_RAW as opposed to SOCK_STREAM or SOCK_DGRAM. Raw sockets are used for working with ICMP, doing packet sniffing, sending some types of custom TCP packets, etc. Basically anything that isn't UDP or TCP, you'll need a raw socket for.

[cryptonector]

Historically programs like `ping` and `traceroute` use raw sockets. Using raw sockets requires privilege, which is why those historically have been set-uid on Unix systems.

[drewcoo]

https://learn.microsoft.com/en-us/windows/win32/winsock/serv...

And here they explain that if you use SOCK_RAW, you should look out for bad datagrams:

https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-...

[cryptonector]

So is this a vulnerability in specific raw sockets applications (i.e., you could get it right in the application), or a vulnerability in the Windows kernel's TCP/IP stack that is only exploitable when there is a raw sockets application running?

[dboreham]

Raw is a protocol type in the socket api allowing the application to send and receive arbitrary packets (e.g. not packets generated by the system's TCP implementation).

[MadsRC]

Things like wireshark binds to a raw socket rather than using the Windows API

[Someone1234]

The sockets API is a Windows API, and Wireshark does not use it. Instead it uses Npcap, a custom kernel driver.

A raw socket allows creation/consumption of bespoke packet types (i.e. not Tcp/Udp). In this case ICMP.