net: Fix infinite loop in in skb_flow_dissect() (CVE-2013-4348)
svn path=/dists/sid/linux/; revision=20764
This commit is contained in:
parent
b7cc18725e
commit
3a3112b981
|
@ -0,0 +1,82 @@
|
||||||
|
From: Ben Hutchings <ben@decadent.org.uk>
|
||||||
|
Date: Thu, 31 Oct 2013 02:24:12 +0000
|
||||||
|
Subject: net: Fix infinite loop in in skb_flow_dissect() (CVE-2013-4348)
|
||||||
|
|
||||||
|
Jason Wang <jasowang@redhat.com> writes:
|
||||||
|
(via linux-distros@vs.openwall.org etc.)
|
||||||
|
> There's a deadloop path in skb_flow_dissect():
|
||||||
|
>
|
||||||
|
> bool skb_flow_dissect(const struct sk_buff *skb, struct flow_keys *flow)
|
||||||
|
> {
|
||||||
|
> ..
|
||||||
|
>
|
||||||
|
> ip:
|
||||||
|
> iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
|
||||||
|
> if (!iph)
|
||||||
|
> return false;
|
||||||
|
>
|
||||||
|
> if (ip_is_fragment(iph))
|
||||||
|
> ip_proto = 0;
|
||||||
|
> else
|
||||||
|
> ip_proto = iph->protocol;
|
||||||
|
> iph_to_flow_copy_addrs(flow, iph);
|
||||||
|
> nhoff += iph->ihl * 4;
|
||||||
|
> break;
|
||||||
|
> ..
|
||||||
|
>
|
||||||
|
> Here the code does not check whether iph->ihl is zero which may cause
|
||||||
|
> deadloop if a malicous IPIP packet whose ihl is zero. See the above
|
||||||
|
> codes for IPIP. Since the pointer was not move ahead.
|
||||||
|
>
|
||||||
|
> ..
|
||||||
|
> case IPPROTO_IPIP:
|
||||||
|
> proto = htons(ETH_P_IP);
|
||||||
|
> goto ip;
|
||||||
|
> ..
|
||||||
|
> }
|
||||||
|
>
|
||||||
|
> skb_flow_dissect() were used by several places:
|
||||||
|
> - packet scheduler that want classify flows
|
||||||
|
> - skb_get_rxhash() that will be used by RPS, vxlan, multiqueue
|
||||||
|
> tap,macvtap packet fanout
|
||||||
|
> - skb_probe_transport_header() which was used for probing transport
|
||||||
|
> header for DODGY packets
|
||||||
|
> - __skb_get_poff() which will be used by socket filter
|
||||||
|
>
|
||||||
|
> So this could be used to DOS both local and remote machine.
|
||||||
|
>
|
||||||
|
> I was able to
|
||||||
|
>
|
||||||
|
> - DOS the local host machine
|
||||||
|
> - DOS the local host machine by run the reproducer in guest
|
||||||
|
> - DOS one guest with RPS enabled by running the reproducer in another
|
||||||
|
> guest in the same host.
|
||||||
|
>
|
||||||
|
> I believe it could be also used to DOS a remote machine, but I didn't try.
|
||||||
|
>
|
||||||
|
> The issue were introduced by commit
|
||||||
|
> 0744dd00c1b1be99a25b62b1b48df440e82e57e0 (net: introduce
|
||||||
|
> skb_flow_dissect()).
|
||||||
|
>
|
||||||
|
> The fix looks easy, just fail when iph->ihl is zero.
|
||||||
|
|
||||||
|
Accepting any positive value means we can still be made to loop nearly
|
||||||
|
skb->len / 4 times in some cases. But all values < 5 are invalid, so
|
||||||
|
let's reject them and reduce that to skb->len / 20.
|
||||||
|
|
||||||
|
We should probably set a constant limit on the loop count as well, but
|
||||||
|
I'm not sure what the limit should be.
|
||||||
|
|
||||||
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
||||||
|
---
|
||||||
|
--- a/net/core/flow_dissector.c
|
||||||
|
+++ b/net/core/flow_dissector.c
|
||||||
|
@@ -40,7 +40,7 @@ again:
|
||||||
|
struct iphdr _iph;
|
||||||
|
ip:
|
||||||
|
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
|
||||||
|
- if (!iph)
|
||||||
|
+ if (!iph || iph->ihl < 5)
|
||||||
|
return false;
|
||||||
|
|
||||||
|
if (ip_is_fragment(iph))
|
|
@ -80,3 +80,4 @@ bugfix/all/crypto-ansi_cprng-Fix-off-by-one-error-in-non-block-.patch
|
||||||
features/all/mvsas-Recognise-device-subsystem-9485-9485-as-88SE94.patch
|
features/all/mvsas-Recognise-device-subsystem-9485-9485-as-88SE94.patch
|
||||||
bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
|
bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
|
||||||
bugfix/all/UAPI-include-asm-byteorder.h-in-linux-raid-md_p.h.patch
|
bugfix/all/UAPI-include-asm-byteorder.h-in-linux-raid-md_p.h.patch
|
||||||
|
bugfix/all/CVE-2013-4348.patch
|
||||||
|
|
Loading…
Reference in New Issue