From 297be792a99a2ffdb13871f07bfb35eef6febdf2 Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Fri, 8 Jan 2016 15:05:54 +0100 Subject: netfilter: CVE-2014-8160 Fixes a flaw in the Linux kernel's netfilter subsystem. Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8160 Upstrem fix: https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/ patch/?id=efbf300ed821a533c3af71b1b122227febc28142 Signed-off-by: Sona Sarmadi Signed-off-by: Paul Vaduva --- .../netfilter-CVE-2014-8160-3.14-kernel.patch | 98 ++++++++++++++++++++++ recipes-kernel/linux/linux-yocto_3.14.bbappend | 1 + 2 files changed, 99 insertions(+) create mode 100644 recipes-kernel/linux/files/netfilter-CVE-2014-8160-3.14-kernel.patch diff --git a/recipes-kernel/linux/files/netfilter-CVE-2014-8160-3.14-kernel.patch b/recipes-kernel/linux/files/netfilter-CVE-2014-8160-3.14-kernel.patch new file mode 100644 index 0000000..9e56598 --- /dev/null +++ b/recipes-kernel/linux/files/netfilter-CVE-2014-8160-3.14-kernel.patch @@ -0,0 +1,98 @@ +From efbf300ed821a533c3af71b1b122227febc28142 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 26 Sep 2014 11:35:42 +0200 +Subject: netfilter: conntrack: disable generic tracking for known protocols + +commit db29a9508a9246e77087c5531e45b2c88ec6988b upstream. + +Given following iptables ruleset: + +-P FORWARD DROP +-A FORWARD -m sctp --dport 9 -j ACCEPT +-A FORWARD -p tcp --dport 80 -j ACCEPT +-A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT + +One would assume that this allows SCTP on port 9 and TCP on port 80. +Unfortunately, if the SCTP conntrack module is not loaded, this allows +*all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT, +which we think is a security issue. + +This is because on the first SCTP packet on port 9, we create a dummy +"generic l4" conntrack entry without any port information (since +conntrack doesn't know how to extract this information). + +All subsequent packets that are unknown will then be in established +state since they will fallback to proto_generic and will match the +'generic' entry. + +Our originally proposed version [1] completely disabled generic protocol +tracking, but Jozsef suggests to not track protocols for which a more +suitable helper is available, hence we now mitigate the issue for in +tree known ct protocol helpers only, so that at least NAT and direction +information will still be preserved for others. + + [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html + +Joint work with Daniel Borkmann. + +Fixes CVE-2014-8160. +Upstream-Status: Backport + +Signed-off-by: Florian Westphal +Signed-off-by: Daniel Borkmann +Acked-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Zhiqiang Zhang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sona Sarmadi +--- + net/netfilter/nf_conntrack_proto_generic.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c +index d25f293..957c1db 100644 +--- a/net/netfilter/nf_conntrack_proto_generic.c ++++ b/net/netfilter/nf_conntrack_proto_generic.c +@@ -14,6 +14,30 @@ + + static unsigned int nf_ct_generic_timeout __read_mostly = 600*HZ; + ++static bool nf_generic_should_process(u8 proto) ++{ ++ switch (proto) { ++#ifdef CONFIG_NF_CT_PROTO_SCTP_MODULE ++ case IPPROTO_SCTP: ++ return false; ++#endif ++#ifdef CONFIG_NF_CT_PROTO_DCCP_MODULE ++ case IPPROTO_DCCP: ++ return false; ++#endif ++#ifdef CONFIG_NF_CT_PROTO_GRE_MODULE ++ case IPPROTO_GRE: ++ return false; ++#endif ++#ifdef CONFIG_NF_CT_PROTO_UDPLITE_MODULE ++ case IPPROTO_UDPLITE: ++ return false; ++#endif ++ default: ++ return true; ++ } ++} ++ + static inline struct nf_generic_net *generic_pernet(struct net *net) + { + return &net->ct.nf_ct_proto.generic; +@@ -67,7 +91,7 @@ static int generic_packet(struct nf_conn *ct, + static bool generic_new(struct nf_conn *ct, const struct sk_buff *skb, + unsigned int dataoff, unsigned int *timeouts) + { +- return true; ++ return nf_generic_should_process(nf_ct_protonum(ct)); + } + + #if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT) +-- +cgit v0.11.2 + diff --git a/recipes-kernel/linux/linux-yocto_3.14.bbappend b/recipes-kernel/linux/linux-yocto_3.14.bbappend index 0f6b5f1..b7933d1 100644 --- a/recipes-kernel/linux/linux-yocto_3.14.bbappend +++ b/recipes-kernel/linux/linux-yocto_3.14.bbappend @@ -2,6 +2,7 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/files:" SRC_URI += "file://HID_CVE_patches/0005-HID-steelseries-validate-output-report-details.patch \ file://splice-CVE-2014-7822-3.14-kernel.patch \ + file://netfilter-CVE-2014-8160-3.14-kernel.patch \ file://keys-CVE-2015-1333.patch \ file://udp_fix_behavior_of_wrong_checksums.patch \ file://net-CVE-2015-2041.patch \ -- cgit v1.2.3-54-g00ecf