From da9b21cafedbe210b4d6b399e513a21017fee7c1 Mon Sep 17 00:00:00 2001 From: Andreas Wellving Date: Wed, 10 Jul 2019 12:12:49 +0200 Subject: tcp: CVE-2019-11479 tcp: add tcp_min_snd_mss sysctl tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() References: https://nvd.nist.gov/vuln/detail/CVE-2019-11479 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=8e39cbc03dafa3731d22533f869bf326c0e6e6f8 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=7e9096287352d0416f3caa0919c90bd9ed2f68d3 Change-Id: I75cade9036c762b5a2cc4512b87fcf96a66f11a0 Signed-off-by: Andreas Wellving --- patches/cve/4.9.x.scc | 2 + ...2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch | 142 +++++++++++++++++++++ ...nforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch | 46 +++++++ 3 files changed, 190 insertions(+) create mode 100644 patches/cve/CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch create mode 100644 patches/cve/CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc index ad03493..18412cb 100644 --- a/patches/cve/4.9.x.scc +++ b/patches/cve/4.9.x.scc @@ -48,3 +48,5 @@ patch CVE-2018-20836-scsi-libsas-fix-a-race-condition-when-smp-task-timeo.patch patch CVE-2019-11477-tcp-limit-payload-size-of-sacked-skbs.patch patch CVE-2019-11478-tcp-tcp_fragment-should-apply-sane-memory-limits.patch patch CVE-2019-11478-tcp-refine-memory-limit-test-in-tcp_fragment.patch +patch CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch +patch CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch diff --git a/patches/cve/CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch b/patches/cve/CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch new file mode 100644 index 0000000..9cb6467 --- /dev/null +++ b/patches/cve/CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch @@ -0,0 +1,142 @@ +From 8e39cbc03dafa3731d22533f869bf326c0e6e6f8 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 15 Jun 2019 17:44:24 -0700 +Subject: [PATCH] tcp: add tcp_min_snd_mss sysctl + +commit 5f3e2bf008c2221478101ee72f5cb4654b9fc363 upstream. + +Some TCP peers announce a very small MSS option in their SYN and/or +SYN/ACK messages. + +This forces the stack to send packets with a very high network/cpu +overhead. + +Linux has enforced a minimal value of 48. Since this value includes +the size of TCP options, and that the options can consume up to 40 +bytes, this means that each segment can include only 8 bytes of payload. + +In some cases, it can be useful to increase the minimal value +to a saner value. + +We still let the default to 48 (TCP_MIN_SND_MSS), for compatibility +reasons. + +Note that TCP_MAXSEG socket option enforces a minimal value +of (TCP_MIN_MSS). David Miller increased this minimal value +in commit c39508d6f118 ("tcp: Make TCP_MAXSEG minimum more correct.") +from 64 to 88. + +We might in the future merge TCP_MIN_SND_MSS and TCP_MIN_MSS. + +CVE-2019-11479 -- tcp mss hardcoded to 48 + +CVE: CVE-2019-11479 +Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=8e39cbc03dafa3731d22533f869bf326c0e6e6f8] + +Signed-off-by: Eric Dumazet +Suggested-by: Jonathan Looney +Acked-by: Neal Cardwell +Cc: Yuchung Cheng +Cc: Tyler Hicks +Cc: Bruce Curtis +Cc: Jonathan Lemon +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Andreas Wellving +--- + Documentation/networking/ip-sysctl.txt | 8 ++++++++ + include/net/netns/ipv4.h | 1 + + net/ipv4/sysctl_net_ipv4.c | 11 +++++++++++ + net/ipv4/tcp_ipv4.c | 1 + + net/ipv4/tcp_output.c | 3 +-- + 5 files changed, 22 insertions(+), 2 deletions(-) + +diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt +index 0335285f3918..49935d5bb5c6 100644 +--- a/Documentation/networking/ip-sysctl.txt ++++ b/Documentation/networking/ip-sysctl.txt +@@ -230,6 +230,14 @@ tcp_base_mss - INTEGER + Path MTU discovery (MTU probing). If MTU probing is enabled, + this is the initial MSS used by the connection. + ++tcp_min_snd_mss - INTEGER ++ TCP SYN and SYNACK messages usually advertise an ADVMSS option, ++ as described in RFC 1122 and RFC 6691. ++ If this ADVMSS option is smaller than tcp_min_snd_mss, ++ it is silently capped to tcp_min_snd_mss. ++ ++ Default : 48 (at least 8 bytes of payload per segment) ++ + tcp_congestion_control - STRING + Set the congestion control algorithm to be used for new + connections. The algorithm "reno" is always available, but +diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h +index 7adf4386ac8f..bf619a67ec03 100644 +--- a/include/net/netns/ipv4.h ++++ b/include/net/netns/ipv4.h +@@ -94,6 +94,7 @@ struct netns_ipv4 { + #endif + int sysctl_tcp_mtu_probing; + int sysctl_tcp_base_mss; ++ int sysctl_tcp_min_snd_mss; + int sysctl_tcp_probe_threshold; + u32 sysctl_tcp_probe_interval; + +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 85713adf2770..e202babb14d6 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -35,6 +35,8 @@ static int ip_local_port_range_min[] = { 1, 1 }; + static int ip_local_port_range_max[] = { 65535, 65535 }; + static int tcp_adv_win_scale_min = -31; + static int tcp_adv_win_scale_max = 31; ++static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS; ++static int tcp_min_snd_mss_max = 65535; + static int ip_ttl_min = 1; + static int ip_ttl_max = 255; + static int tcp_syn_retries_min = 1; +@@ -838,6 +840,15 @@ static struct ctl_table ipv4_net_table[] = { + .mode = 0644, + .proc_handler = proc_dointvec, + }, ++ { ++ .procname = "tcp_min_snd_mss", ++ .data = &init_net.ipv4.sysctl_tcp_min_snd_mss, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &tcp_min_snd_mss_min, ++ .extra2 = &tcp_min_snd_mss_max, ++ }, + { + .procname = "tcp_probe_threshold", + .data = &init_net.ipv4.sysctl_tcp_probe_threshold, +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 82c1064ff4aa..848f2c1da8a5 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2456,6 +2456,7 @@ static int __net_init tcp_sk_init(struct net *net) + net->ipv4.sysctl_tcp_ecn_fallback = 1; + + net->ipv4.sysctl_tcp_base_mss = TCP_BASE_MSS; ++ net->ipv4.sysctl_tcp_min_snd_mss = TCP_MIN_SND_MSS; + net->ipv4.sysctl_tcp_probe_threshold = TCP_PROBE_THRESHOLD; + net->ipv4.sysctl_tcp_probe_interval = TCP_PROBE_INTERVAL; + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 123b2d8fde46..d8c6b833f0ce 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1360,8 +1360,7 @@ static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu) + mss_now -= icsk->icsk_ext_hdr_len; + + /* Then reserve room for full set of TCP options and 8 bytes of data */ +- if (mss_now < TCP_MIN_SND_MSS) +- mss_now = TCP_MIN_SND_MSS; ++ mss_now = max(mss_now, sock_net(sk)->ipv4.sysctl_tcp_min_snd_mss); + return mss_now; + } + +-- +2.20.1 + diff --git a/patches/cve/CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch b/patches/cve/CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch new file mode 100644 index 0000000..5576fcf --- /dev/null +++ b/patches/cve/CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch @@ -0,0 +1,46 @@ +From 7e9096287352d0416f3caa0919c90bd9ed2f68d3 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 15 Jun 2019 17:47:27 -0700 +Subject: [PATCH] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() + +commit 967c05aee439e6e5d7d805e195b3a20ef5c433d6 upstream. + +If mtu probing is enabled tcp_mtu_probing() could very well end up +with a too small MSS. + +Use the new sysctl tcp_min_snd_mss to make sure MSS search +is performed in an acceptable range. + +CVE-2019-11479 -- tcp mss hardcoded to 48 + +CVE: CVE-2019-11479 fix +Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=7e9096287352d0416f3caa0919c90bd9ed2f68d3] + +Signed-off-by: Eric Dumazet +Reported-by: Jonathan Lemon +Cc: Jonathan Looney +Acked-by: Neal Cardwell +Cc: Yuchung Cheng +Cc: Tyler Hicks +Cc: Bruce Curtis +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Andreas Wellving +--- + net/ipv4/tcp_timer.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 69523389f067..d9e364c4863a 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -140,6 +140,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk) + mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1; + mss = min(net->ipv4.sysctl_tcp_base_mss, mss); + mss = max(mss, 68 - tp->tcp_header_len); ++ mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss); + icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss); + tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); + } +-- +2.20.1 -- cgit v1.2.3-54-g00ecf