[Devel,RHEL7,COMMIT] ms/tcp: make challenge acks less predictable

Submitted by Konstantin Khorenko on Aug. 19, 2016, 12:56 p.m.

Details

Message ID 201608191256.u7JCuNtD025115@finist_cl7.x64_64.work.ct
State New
Series "ms/tcp: make challenge acks less predictable"
Headers show

Commit Message

Konstantin Khorenko Aug. 19, 2016, 12:56 p.m.
The commit is pushed to "branch-rh7-3.10.0-327.28.2.vz7.17.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.28.2.vz7.17.1
------>
commit 25e0c77a1021261a217631850fd084876e3794de
Author: Vasily Averin <vvs@virtuozzo.com>
Date:   Fri Aug 19 16:56:23 2016 +0400

    ms/tcp: make challenge acks less predictable
    
    upstream patch:
    https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758
    fixes CVE-2016-5696 challenge ACK counter information disclosure
    
    >From 75ff39ccc1bd5d3c455b6822ab09e533c551f758 Mon Sep 17 00:00:00 2001
    From: Eric Dumazet <edumazet@google.com>
    Date: Sun, 10 Jul 2016 10:04:02 +0200
    Subject: tcp: make challenge acks less predictable
    
    Yue Cao claims that current host rate limiting of challenge ACKS
    (RFC 5961) could leak enough information to allow a patient attacker
    to hijack TCP sessions. He will soon provide details in an academic
    paper.
    
    This patch increases the default limit from 100 to 1000, and adds
    some randomization so that the attacker can no longer hijack
    sessions without spending a considerable amount of probes.
    
    Based on initial analysis and patch from Linus.
    
    Note that we also have per socket rate limiting, so it is tempting
    to remove the host limit in the future.
    
    v2: randomize the count of challenge acks per second, not the period.
    
    Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
    Reported-by: Yue Cao <ycao009@ucr.edu>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Yuchung Cheng <ycheng@google.com>
    Cc: Neal Cardwell <ncardwell@google.com>
    Acked-by: Neal Cardwell <ncardwell@google.com>
    Acked-by: Yuchung Cheng <ycheng@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    
    https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5696
    https://jira.sw.ru/browse/PSBM-50954
    
    Signed-off-by:	Vasily Averin <vvs@virtuozzo.com>
---
 net/ipv4/tcp_input.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

Patch hide | download patch | download mbox

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d987f31..ed1261e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -86,7 +86,7 @@  int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 /* rfc5961 challenge ack rate limiting */
-int sysctl_tcp_challenge_ack_limit = 100;
+int sysctl_tcp_challenge_ack_limit = 1000;
 
 int sysctl_tcp_stdurg __read_mostly;
 int sysctl_tcp_rfc1337 __read_mostly;
@@ -3302,7 +3302,7 @@  static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
 	static u32 challenge_timestamp;
 	static unsigned int challenge_count;
 	struct tcp_sock *tp = tcp_sk(sk);
-	u32 now;
+	u32 count, now;
 
 	/* First check our per-socket dupack rate limit. */
 	if (tcp_oow_rate_limited(sock_net(sk), skb,
@@ -3310,13 +3310,18 @@  static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
 				 &tp->last_oow_ack_time))
 		return;
 
-	/* Then check the check host-wide RFC 5961 rate limit. */
+	/* Then check host-wide RFC 5961 rate limit. */
 	now = jiffies / HZ;
 	if (now != challenge_timestamp) {
+		u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
+
 		challenge_timestamp = now;
-		challenge_count = 0;
+		WRITE_ONCE(challenge_count, half +
+			   prandom_u32_max(sysctl_tcp_challenge_ack_limit));
 	}
-	if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
+	count = READ_ONCE(challenge_count);
+	if (count > 0) {
+		WRITE_ONCE(challenge_count, count - 1);
 		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
 		tcp_send_ack(sk);
 	}

Comments

Konstantin Khorenko Aug. 19, 2016, 1:04 p.m.
No rush with the kernel here as ReadyKernel patch (no reboot!) for Virtuozzo 7 was published even prior to RHEL7 kernel update.

https://readykernel.com/patch/readykernel-patch-15.2-2.1-1.vl7/
https://virtuozzo.com/reasons-upgrade-virtuozzo-7/

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 08/19/2016 03:56 PM, Konstantin Khorenko wrote:
> The commit is pushed to "branch-rh7-3.10.0-327.28.2.vz7.17.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
> after rh7-3.10.0-327.28.2.vz7.17.1
> ------>
> commit 25e0c77a1021261a217631850fd084876e3794de
> Author: Vasily Averin <vvs@virtuozzo.com>
> Date:   Fri Aug 19 16:56:23 2016 +0400
>
>     ms/tcp: make challenge acks less predictable
>
>     upstream patch:
>     https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758
>     fixes CVE-2016-5696 challenge ACK counter information disclosure
>
>     >From 75ff39ccc1bd5d3c455b6822ab09e533c551f758 Mon Sep 17 00:00:00 2001
>     From: Eric Dumazet <edumazet@google.com>
>     Date: Sun, 10 Jul 2016 10:04:02 +0200
>     Subject: tcp: make challenge acks less predictable
>
>     Yue Cao claims that current host rate limiting of challenge ACKS
>     (RFC 5961) could leak enough information to allow a patient attacker
>     to hijack TCP sessions. He will soon provide details in an academic
>     paper.
>
>     This patch increases the default limit from 100 to 1000, and adds
>     some randomization so that the attacker can no longer hijack
>     sessions without spending a considerable amount of probes.
>
>     Based on initial analysis and patch from Linus.
>
>     Note that we also have per socket rate limiting, so it is tempting
>     to remove the host limit in the future.
>
>     v2: randomize the count of challenge acks per second, not the period.
>
>     Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
>     Reported-by: Yue Cao <ycao009@ucr.edu>
>     Signed-off-by: Eric Dumazet <edumazet@google.com>
>     Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
>     Cc: Yuchung Cheng <ycheng@google.com>
>     Cc: Neal Cardwell <ncardwell@google.com>
>     Acked-by: Neal Cardwell <ncardwell@google.com>
>     Acked-by: Yuchung Cheng <ycheng@google.com>
>     Signed-off-by: David S. Miller <davem@davemloft.net>
>
>     https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5696
>     https://jira.sw.ru/browse/PSBM-50954
>
>     Signed-off-by:	Vasily Averin <vvs@virtuozzo.com>
> ---
>  net/ipv4/tcp_input.c | 15 ++++++++++-----
>  1 file changed, 10 insertions(+), 5 deletions(-)
>
> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index d987f31..ed1261e 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
> @@ -86,7 +86,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1;
>  EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
>
>  /* rfc5961 challenge ack rate limiting */
> -int sysctl_tcp_challenge_ack_limit = 100;
> +int sysctl_tcp_challenge_ack_limit = 1000;
>
>  int sysctl_tcp_stdurg __read_mostly;
>  int sysctl_tcp_rfc1337 __read_mostly;
> @@ -3302,7 +3302,7 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
>  	static u32 challenge_timestamp;
>  	static unsigned int challenge_count;
>  	struct tcp_sock *tp = tcp_sk(sk);
> -	u32 now;
> +	u32 count, now;
>
>  	/* First check our per-socket dupack rate limit. */
>  	if (tcp_oow_rate_limited(sock_net(sk), skb,
> @@ -3310,13 +3310,18 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
>  				 &tp->last_oow_ack_time))
>  		return;
>
> -	/* Then check the check host-wide RFC 5961 rate limit. */
> +	/* Then check host-wide RFC 5961 rate limit. */
>  	now = jiffies / HZ;
>  	if (now != challenge_timestamp) {
> +		u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
> +
>  		challenge_timestamp = now;
> -		challenge_count = 0;
> +		WRITE_ONCE(challenge_count, half +
> +			   prandom_u32_max(sysctl_tcp_challenge_ack_limit));
>  	}
> -	if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
> +	count = READ_ONCE(challenge_count);
> +	if (count > 0) {
> +		WRITE_ONCE(challenge_count, count - 1);
>  		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
>  		tcp_send_ack(sk);
>  	}
> .
>