83 lines
2.5 KiB
Diff
83 lines
2.5 KiB
Diff
From: Ben Hutchings <ben@decadent.org.uk>
|
|
Date: Thu, 31 Oct 2013 02:24:12 +0000
|
|
Subject: net: Fix infinite loop in in skb_flow_dissect() (CVE-2013-4348)
|
|
|
|
Jason Wang <jasowang@redhat.com> writes:
|
|
(via linux-distros@vs.openwall.org etc.)
|
|
> There's a deadloop path in skb_flow_dissect():
|
|
>
|
|
> bool skb_flow_dissect(const struct sk_buff *skb, struct flow_keys *flow)
|
|
> {
|
|
> ..
|
|
>
|
|
> ip:
|
|
> iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
|
|
> if (!iph)
|
|
> return false;
|
|
>
|
|
> if (ip_is_fragment(iph))
|
|
> ip_proto = 0;
|
|
> else
|
|
> ip_proto = iph->protocol;
|
|
> iph_to_flow_copy_addrs(flow, iph);
|
|
> nhoff += iph->ihl * 4;
|
|
> break;
|
|
> ..
|
|
>
|
|
> Here the code does not check whether iph->ihl is zero which may cause
|
|
> deadloop if a malicous IPIP packet whose ihl is zero. See the above
|
|
> codes for IPIP. Since the pointer was not move ahead.
|
|
>
|
|
> ..
|
|
> case IPPROTO_IPIP:
|
|
> proto = htons(ETH_P_IP);
|
|
> goto ip;
|
|
> ..
|
|
> }
|
|
>
|
|
> skb_flow_dissect() were used by several places:
|
|
> - packet scheduler that want classify flows
|
|
> - skb_get_rxhash() that will be used by RPS, vxlan, multiqueue
|
|
> tap,macvtap packet fanout
|
|
> - skb_probe_transport_header() which was used for probing transport
|
|
> header for DODGY packets
|
|
> - __skb_get_poff() which will be used by socket filter
|
|
>
|
|
> So this could be used to DOS both local and remote machine.
|
|
>
|
|
> I was able to
|
|
>
|
|
> - DOS the local host machine
|
|
> - DOS the local host machine by run the reproducer in guest
|
|
> - DOS one guest with RPS enabled by running the reproducer in another
|
|
> guest in the same host.
|
|
>
|
|
> I believe it could be also used to DOS a remote machine, but I didn't try.
|
|
>
|
|
> The issue were introduced by commit
|
|
> 0744dd00c1b1be99a25b62b1b48df440e82e57e0 (net: introduce
|
|
> skb_flow_dissect()).
|
|
>
|
|
> The fix looks easy, just fail when iph->ihl is zero.
|
|
|
|
Accepting any positive value means we can still be made to loop nearly
|
|
skb->len / 4 times in some cases. But all values < 5 are invalid, so
|
|
let's reject them and reduce that to skb->len / 20.
|
|
|
|
We should probably set a constant limit on the loop count as well, but
|
|
I'm not sure what the limit should be.
|
|
|
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
---
|
|
--- a/net/core/flow_dissector.c
|
|
+++ b/net/core/flow_dissector.c
|
|
@@ -40,7 +40,7 @@ again:
|
|
struct iphdr _iph;
|
|
ip:
|
|
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
|
|
- if (!iph)
|
|
+ if (!iph || iph->ihl < 5)
|
|
return false;
|
|
|
|
if (ip_is_fragment(iph))
|