In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/iucv: filter frames in afiucv_hs_rcv() by ingress device<\/p>\n
afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte
\nname fields in the transport header alone. No check is made against the
\nnet_device the frame arrived on.<\/p>\n
This can cause a frame arriving on any netdev to be delivered to an AF_IUCV
\nsocket. Three problems follow.<\/p>\n
First, a frame arriving over HiperSockets can be delivered to a socket
\nbound to the classic z\/VM IUCV transport, which has iucv->hs_dev == NULL.
\niucv_sock_bind() takes the classic path whenever the requested userid
\nmatches iucv_userid, even on a guest that also has a HiperSockets device
\ncarrying the same identifier. The child socket created by
\nafiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and
\ntransport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.
\nThe socket delivered to accept() is unusable.<\/p>\n
Second, a frame arriving on one netdev can be delivered to a socket bound
\nto a different IQD device. Which can lead to
\n– Accept-queue exhaustion (DoS)
\n– Attacker-controlled peer identity in the child socket
\n– Data injection into existing sockets
\n– Fabric noise on the IQD fabric, where bogus replies are sent
\n– killing established connections<\/p>\n
Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls
\nsk_alloc(&init_net, …). But even frames arriving on netdev devices in a
\nnamespace can be delivered to an IUCV socket. So a process in an
\nunprivileged user and network namespace holding only the CAP_NET_RAW
\ncapability valid within that namespace can send a raw ETH_P_AF_IUCV frame
\non its own lo device and have it matched against init_net sockets.<\/p>\n
Fix all three by skipping any socket whose hs_dev does not match the
\ningress device. A classic z\/VM IUCV socket has hs_dev == NULL; the ingress
\ndev is never NULL, so classic sockets are skipped automatically. An unbound
\nHIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket
\nis only reachable from the exact IQD device it was bound to. Because hs_dev
\nis always a device in init_net (iucv_sock_bind() scans
\nfor_each_netdev_rcu(&init_net, …) exclusively), a frame whose ingress
\ndevice belongs to another namespace never matches any socket.<\/p>\n
Note that AF_IUCV over HiperSockets provides no per-connection
\nauthentication: no sequence numbers, no TLS, no nonce. The four name fields
\nidentifying a connection are exchanged in plaintext on the shared
\nHiperSockets segment (VCHID). Any host on the same HiperSockets segment
\ncould spoof any frame type against an existing connection. That is a
\nprotocol-level property unchanged by this patch. The fix reduces the attack
\nsurface to peers present on the same HiperSockets segment.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/iucv: filter frames in afiucv_hs_rcv() by ingress device<\/p>\n
afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21336","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}