summaryrefslogtreecommitdiffstats
path: root/recipes-kernel/linux/files/CVE-2016-5696-make-challenge-acks-less-predictable.patch
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-kernel/linux/files/CVE-2016-5696-make-challenge-acks-less-predictable.patch')
-rw-r--r--recipes-kernel/linux/files/CVE-2016-5696-make-challenge-acks-less-predictable.patch88
1 files changed, 88 insertions, 0 deletions
diff --git a/recipes-kernel/linux/files/CVE-2016-5696-make-challenge-acks-less-predictable.patch b/recipes-kernel/linux/files/CVE-2016-5696-make-challenge-acks-less-predictable.patch
new file mode 100644
index 0000000..fe67b3b
--- /dev/null
+++ b/recipes-kernel/linux/files/CVE-2016-5696-make-challenge-acks-less-predictable.patch
@@ -0,0 +1,88 @@
1From 72c2d3bccaba4a0a4de354f9d2d24eccd05bfccf Mon Sep 17 00:00:00 2001
2From: Eric Dumazet <edumazet@google.com>
3Date: Sun, 10 Jul 2016 10:04:02 +0200
4Subject: [PATCH] tcp: make challenge acks less predictable
5
6[ Upstream commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 ]
7
8Yue Cao claims that current host rate limiting of challenge ACKS
9(RFC 5961) could leak enough information to allow a patient attacker
10to hijack TCP sessions. He will soon provide details in an academic
11paper.
12
13This patch increases the default limit from 100 to 1000, and adds
14some randomization so that the attacker can no longer hijack
15sessions without spending a considerable amount of probes.
16
17Based on initial analysis and patch from Linus.
18
19Note that we also have per socket rate limiting, so it is tempting
20to remove the host limit in the future.
21
22v2: randomize the count of challenge acks per second, not the period.
23
24CVE: CVE-2016-5696
25Upstream-Status: Backport
26
27Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
28Reported-by: Yue Cao <ycao009@ucr.edu>
29Signed-off-by: Eric Dumazet <edumazet@google.com>
30Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
31Cc: Yuchung Cheng <ycheng@google.com>
32Cc: Neal Cardwell <ncardwell@google.com>
33Acked-by: Neal Cardwell <ncardwell@google.com>
34Acked-by: Yuchung Cheng <ycheng@google.com>
35Signed-off-by: David S. Miller <davem@davemloft.net>
36Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
37Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
38---
39 net/ipv4/tcp_input.c | 15 ++++++++++-----
40 1 file changed, 10 insertions(+), 5 deletions(-)
41
42diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
43index d4c5115..05f10df 100644
44--- a/net/ipv4/tcp_input.c
45+++ b/net/ipv4/tcp_input.c
46@@ -89,7 +89,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1;
47 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
48
49 /* rfc5961 challenge ack rate limiting */
50-int sysctl_tcp_challenge_ack_limit = 100;
51+int sysctl_tcp_challenge_ack_limit = 1000;
52
53 int sysctl_tcp_stdurg __read_mostly;
54 int sysctl_tcp_rfc1337 __read_mostly;
55@@ -3427,7 +3427,7 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
56 static u32 challenge_timestamp;
57 static unsigned int challenge_count;
58 struct tcp_sock *tp = tcp_sk(sk);
59- u32 now;
60+ u32 count, now;
61
62 /* First check our per-socket dupack rate limit. */
63 if (tcp_oow_rate_limited(sock_net(sk), skb,
64@@ -3435,13 +3435,18 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
65 &tp->last_oow_ack_time))
66 return;
67
68- /* Then check the check host-wide RFC 5961 rate limit. */
69+ /* Then check host-wide RFC 5961 rate limit. */
70 now = jiffies / HZ;
71 if (now != challenge_timestamp) {
72+ u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
73+
74 challenge_timestamp = now;
75- challenge_count = 0;
76+ WRITE_ONCE(challenge_count, half +
77+ prandom_u32_max(sysctl_tcp_challenge_ack_limit));
78 }
79- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
80+ count = READ_ONCE(challenge_count);
81+ if (count > 0) {
82+ WRITE_ONCE(challenge_count, count - 1);
83 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
84 tcp_send_ack(sk);
85 }
86--
871.9.1
88