In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction<\/p>\n
Blamed commit moved the TIME_WAIT-derived ISN from the skb control
\nblock to a per-CPU variable, assuming the value would always be consumed
\nby tcp_conn_request() for the same packet that wrote it. That assumption
\nis violated by multiple drop paths between the producer
\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer
\n(tcp_conn_request()):<\/p>\n
– min_ttl \/ min_hopcount check
\n – xfrm policy check
\n – tcp_inbound_hash() MD5\/AO mismatch
\n – tcp_filter() eBPF\/SO_ATTACH_FILTER drop
\n – th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN
\n – psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()
\n – tcp_checksum_complete() in tcp_v{4,6}_do_rcv()
\n – tcp_v{4,6}_cookie_check() returning NULL<\/p>\n
When a packet is dropped on any of these paths, tcp_tw_isn is left set.<\/p>\n
The next SYN processed on the same CPU then consumes the non zero value in
\ntcp_conn_request(), receiving a potentially predictable ISN.<\/p>\n
This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu
\nvariable.<\/p>\n
Note that tcp_v{4,6}_fill_cb() do not set it.<\/p>\n
Very litle impact on overall code size\/complexity:<\/p>\n
$ scripts\/bloat-o-meter -t vmlinux.old vmlinux.new
\nadd\/remove: 0\/0 grow\/shrink: 2\/1 up\/down: 8\/-15 (-7)
\nFunction old new delta
\ntcp_v6_rcv 3038 3042 +4
\ntcp_v4_rcv 3035 3039 +4
\ntcp_conn_request 2938 2923 -15
\nTotal: Before=24436060, After=24436053, chg -0.00%<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction<\/p>\n
Blamed commit moved the TIME_WAIT-derived ISN from the skb control<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15017","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15017","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15017"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15017"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15017"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}