[meta-freescale] [PATCH] linux-qoriq: fix CVE-2016-5696
Adrian Dudau
adrian.dudau at enea.com
Mon Oct 31 07:53:01 PDT 2016
net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not
properly determine the rate of challenge ACK segments, which
makes it easier for man-in-the-middle attackers to hijack TCP
sessions via a blind in-window attack.
References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5696
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/
patch/?id=5413f1a526d2d51d7a5768133c90936c017165c6
https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/
patch/?id=72c2d3bccaba4a0a4de354f9d2d24eccd05bfccf (This a follow-up
to "tcp: make challenge acks less predictable)
Signed-off-by: Adrian Dudau <adrian.dudau at enea.com>
---
.../CVE-2016-5696-limiting-of-all-challenge.patch | 111 +++++++++++++++++++++
...5696-make-challenge-acks-less-predictable.patch | 90 +++++++++++++++++
recipes-kernel/linux/linux-qoriq_4.1.bb | 2 +
3 files changed, 203 insertions(+)
create mode 100644 recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch
create mode 100644 recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch
diff --git a/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch b/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch
new file mode 100644
index 0000000..d1f97cd
--- /dev/null
+++ b/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch
@@ -0,0 +1,111 @@
+From 5413f1a526d2d51d7a5768133c90936c017165c6 Mon Sep 17 00:00:00 2001
+From: Jason Baron <jbaron at akamai.com>
+Date: Thu, 14 Jul 2016 11:38:40 -0400
+Subject: [PATCH] tcp: enable per-socket rate limiting of all 'challenge acks'
+
+[ Upstream commit 083ae308280d13d187512b9babe3454342a7987e ]
+
+The per-socket rate limit for 'challenge acks' was introduced in the
+context of limiting ack loops:
+
+commit f2b2c582e824 ("tcp: mitigate ACK loops for connections as tcp_sock")
+
+And I think it can be extended to rate limit all 'challenge acks' on a
+per-socket basis.
+
+Since we have the global tcp_challenge_ack_limit, this patch allows for
+tcp_challenge_ack_limit to be set to a large value and effectively rely on
+the per-socket limit, or set tcp_challenge_ack_limit to a lower value and
+still prevents a single connections from consuming the entire challenge ack
+quota.
+
+It further moves in the direction of eliminating the global limit at some
+point, as Eric Dumazet has suggested. This a follow-up to:
+Subject: tcp: make challenge acks less predictable
+
+CVE: CVE-2016-5696
+Upstream-Status: Backport
+
+Cc: Eric Dumazet <edumazet at google.com>
+Cc: David S. Miller <davem at davemloft.net>
+Cc: Neal Cardwell <ncardwell at google.com>
+Cc: Yuchung Cheng <ycheng at google.com>
+Cc: Yue Cao <ycao009 at ucr.edu>
+Signed-off-by: Jason Baron <jbaron at akamai.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi at enea.com>
+Signed-off-by: Adrian Dudau <adrian.dudau at enea.com>
+
+---
+ net/ipv4/tcp_input.c | 39 ++++++++++++++++++++++-----------------
+ 1 file changed, 22 insertions(+), 17 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 05f10df..12b98e2 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3390,6 +3390,23 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
+ return flag;
+ }
+
++static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
++ u32 *last_oow_ack_time)
++{
++ if (*last_oow_ack_time) {
++ s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
++
++ if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
++ NET_INC_STATS_BH(net, mib_idx);
++ return true; /* rate-limited: don't send yet! */
++ }
++ }
++
++ *last_oow_ack_time = tcp_time_stamp;
++
++ return false; /* not rate-limited: go ahead, send dupack now! */
++}
++
+ /* Return true if we're currently rate-limiting out-of-window ACKs and
+ * thus shouldn't send a dupack right now. We rate-limit dupacks in
+ * response to out-of-window SYNs or ACKs to mitigate ACK loops or DoS
+@@ -3403,21 +3420,9 @@ bool tcp_oow_rate_limited(struct net *net, const struct sk_buff *skb,
+ /* Data packets without SYNs are not likely part of an ACK loop. */
+ if ((TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq) &&
+ !tcp_hdr(skb)->syn)
+- goto not_rate_limited;
+-
+- if (*last_oow_ack_time) {
+- s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
+-
+- if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
+- NET_INC_STATS_BH(net, mib_idx);
+- return true; /* rate-limited: don't send yet! */
+- }
+- }
+-
+- *last_oow_ack_time = tcp_time_stamp;
++ return false;
+
+-not_rate_limited:
+- return false; /* not rate-limited: go ahead, send dupack now! */
++ return __tcp_oow_rate_limited(net, mib_idx, last_oow_ack_time);
+ }
+
+ /* RFC 5961 7 [ACK Throttling] */
+@@ -3430,9 +3435,9 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
+ u32 count, now;
+
+ /* First check our per-socket dupack rate limit. */
+- if (tcp_oow_rate_limited(sock_net(sk), skb,
+- LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
+- &tp->last_oow_ack_time))
++ if (__tcp_oow_rate_limited(sock_net(sk),
++ LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
++ &tp->last_oow_ack_time))
+ return;
+
+ /* Then check host-wide RFC 5961 rate limit. */
+--
+1.9.1
+
diff --git a/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch b/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch
new file mode 100644
index 0000000..072671a
--- /dev/null
+++ b/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch
@@ -0,0 +1,90 @@
+From 72c2d3bccaba4a0a4de354f9d2d24eccd05bfccf Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet at google.com>
+Date: Sun, 10 Jul 2016 10:04:02 +0200
+Subject: [PATCH] tcp: make challenge acks less predictable
+
+[ Upstream commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 ]
+
+Yue Cao claims that current host rate limiting of challenge ACKS
+(RFC 5961) could leak enough information to allow a patient attacker
+to hijack TCP sessions. He will soon provide details in an academic
+paper.
+
+This patch increases the default limit from 100 to 1000, and adds
+some randomization so that the attacker can no longer hijack
+sessions without spending a considerable amount of probes.
+
+Based on initial analysis and patch from Linus.
+
+Note that we also have per socket rate limiting, so it is tempting
+to remove the host limit in the future.
+
+v2: randomize the count of challenge acks per second, not the period.
+
+CVE: CVE-2016-5696
+Upstream-Status: Backport
+
+Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
+Reported-by: Yue Cao <ycao009 at ucr.edu>
+Signed-off-by: Eric Dumazet <edumazet at google.com>
+Suggested-by: Linus Torvalds <torvalds at linux-foundation.org>
+Cc: Yuchung Cheng <ycheng at google.com>
+Cc: Neal Cardwell <ncardwell at google.com>
+Acked-by: Neal Cardwell <ncardwell at google.com>
+Acked-by: Yuchung Cheng <ycheng at google.com>
+Signed-off-by: David S. Miller <davem at davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi at enea.com>
+Signed-off-by: Adrian Dudau <adrian.dudau at enea.com>
+
+---
+ net/ipv4/tcp_input.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index d4c5115..05f10df 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -89,7 +89,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1;
+ EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+
+ /* rfc5961 challenge ack rate limiting */
+-int sysctl_tcp_challenge_ack_limit = 100;
++int sysctl_tcp_challenge_ack_limit = 1000;
+
+ int sysctl_tcp_stdurg __read_mostly;
+ int sysctl_tcp_rfc1337 __read_mostly;
+@@ -3427,7 +3427,7 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
+ static u32 challenge_timestamp;
+ static unsigned int challenge_count;
+ struct tcp_sock *tp = tcp_sk(sk);
+- u32 now;
++ u32 count, now;
+
+ /* First check our per-socket dupack rate limit. */
+ if (tcp_oow_rate_limited(sock_net(sk), skb,
+@@ -3435,13 +3435,18 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
+ &tp->last_oow_ack_time))
+ return;
+
+- /* Then check the check host-wide RFC 5961 rate limit. */
++ /* Then check host-wide RFC 5961 rate limit. */
+ now = jiffies / HZ;
+ if (now != challenge_timestamp) {
++ u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
++
+ challenge_timestamp = now;
+- challenge_count = 0;
++ WRITE_ONCE(challenge_count, half +
++ prandom_u32_max(sysctl_tcp_challenge_ack_limit));
+ }
+- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
++ count = READ_ONCE(challenge_count);
++ if (count > 0) {
++ WRITE_ONCE(challenge_count, count - 1);
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
+ tcp_send_ack(sk);
+ }
+--
+1.9.1
+
diff --git a/recipes-kernel/linux/linux-qoriq_4.1.bb b/recipes-kernel/linux/linux-qoriq_4.1.bb
index 7a926fd..b5a67e6 100644
--- a/recipes-kernel/linux/linux-qoriq_4.1.bb
+++ b/recipes-kernel/linux/linux-qoriq_4.1.bb
@@ -13,6 +13,8 @@ SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \
file://fix-the-compile-issue-under-gcc6.patch \
file://only-set-vmpic_msi_feature-if-CONFIG_EPAPR_PARAVIRT-.patch \
file://powerpc-fsl-Fix-build-of-the-dtb-embedded-kernel-images.patch \
+ file://CVE-2016-5696-limiting-of-all-challenge.patch \
+ file://CVE-2016-5696-make-challenge-acks-less-predictable.patch \
"
SRCREV = "667e6ba9ca2150b3cabdd0c07b57d1b88ef3b86a"
--
1.9.1
More information about the meta-freescale
mailing list