debian-packaging
/
linux
8
0
Fork 0
Code Releases Activity

net: Fix infinite loop in in skb_flow_dissect() (CVE-2013-4348) 

svn path=/dists/sid/linux/; revision=20764
This commit is contained in:
Ben Hutchings 2013-11-01 01:34:05 +00:00
parent b7cc18725e
commit 3a3112b981
2 changed files with 83 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
debian/patches/bugfix/all/CVE-2013-4348.patch vendored Normal file
View File

@ -0,0 +1,82 @@
From: Ben Hutchings <ben@decadent.org.uk>
Date: Thu, 31 Oct 2013 02:24:12 +0000
Subject: net: Fix infinite loop in in skb_flow_dissect() (CVE-2013-4348)
Jason Wang <jasowang@redhat.com> writes:
(via linux-distros@vs.openwall.org etc.)
> There's a deadloop path in skb_flow_dissect():
>
> bool skb_flow_dissect(const struct sk_buff *skb, struct flow_keys *flow)
> {
> ..
>
> ip:
> iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
> if (!iph)
> return false;
>
> if (ip_is_fragment(iph))
> ip_proto = 0;
> else
> ip_proto = iph->protocol;
> iph_to_flow_copy_addrs(flow, iph);
> nhoff += iph->ihl * 4;
> break;
> ..
>
> Here the code does not check whether iph->ihl is zero which may cause
> deadloop if a malicous IPIP packet whose ihl is zero. See the above
> codes for IPIP. Since the pointer was not move ahead.
>
> ..
> case IPPROTO_IPIP:
> proto = htons(ETH_P_IP);
> goto ip;
> ..
> }
>
> skb_flow_dissect() were used by several places:
> - packet scheduler that want classify flows
> - skb_get_rxhash() that will be used by RPS, vxlan, multiqueue
> tap,macvtap packet fanout
> - skb_probe_transport_header() which was used for probing transport
> header for DODGY packets
> - __skb_get_poff() which will be used by socket filter
>
> So this could be used to DOS both local and remote machine.
>
> I was able to
>
> - DOS the local host machine
> - DOS the local host machine by run the reproducer in guest
> - DOS one guest with RPS enabled by running the reproducer in another
> guest in the same host.
>
> I believe it could be also used to DOS a remote machine, but I didn't try.
>
> The issue were introduced by commit
> 0744dd00c1b1be99a25b62b1b48df440e82e57e0 (net: introduce
> skb_flow_dissect()).
>
> The fix looks easy, just fail when iph->ihl is zero.
Accepting any positive value means we can still be made to loop nearly
skb->len / 4 times in some cases. But all values < 5 are invalid, so
let's reject them and reduce that to skb->len / 20.
We should probably set a constant limit on the loop count as well, but
I'm not sure what the limit should be.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -40,7 +40,7 @@ again:
struct iphdr _iph;
ip:
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
- if (!iph)
+ if (!iph || iph->ihl < 5)
return false;
if (ip_is_fragment(iph))

1
debian/patches/series vendored
View File

@ -80,3 +80,4 @@ bugfix/all/crypto-ansi_cprng-Fix-off-by-one-error-in-non-block-.patch
features/all/mvsas-Recognise-device-subsystem-9485-9485-as-88SE94.patch
bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
bugfix/all/UAPI-include-asm-byteorder.h-in-linux-raid-md_p.h.patch
bugfix/all/CVE-2013-4348.patch