EMBARGOED until Oct 31, via linux-distros

CVE-2013-4348

Jason Wang <jasowang@redhat.com> writes:

There's a deadloop path in skb_flow_dissect():

bool skb_flow_dissect(const struct sk_buff *skb, struct flow_keys *flow)
{
..

ip:
        iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
        if (!iph)
            return false;

        if (ip_is_fragment(iph))
            ip_proto = 0;
        else
            ip_proto = iph->protocol;
        iph_to_flow_copy_addrs(flow, iph);
        nhoff += iph->ihl * 4;
        break;
..

Here the code does not check whether iph->ihl is zero which may cause
deadloop if a malicous IPIP packet whose ihl is zero. See the above
codes for IPIP. Since the pointer was not move ahead.

..
    case IPPROTO_IPIP:
        proto = htons(ETH_P_IP);
        goto ip;
..
}

skb_flow_dissect() were used by several places:
- packet scheduler that want classify flows
- skb_get_rxhash() that will be used by RPS, vxlan, multiqueue
tap,macvtap packet fanout
- skb_probe_transport_header() which was used for probing transport
header for DODGY packets
- __skb_get_poff() which will be used by socket filter

So this could be used to DOS both local and remote machine.

I was able to

- DOS the local host machine
- DOS the local host machine by run the reproducer in guest
- DOS one guest with RPS enabled by running the reproducer in another
guest in the same host.
I believe it could be also used to DOS a remote machine, but I didn't try.

The issue were introduced by commit
0744dd00c1b1be99a25b62b1b48df440e82e57e0 (net: introduce
skb_flow_dissect()).

The fix looks easy, just fail when iph->ihl is zero.

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 0ff42f0..286db61 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -40,7 +40,7 @@ again:
                struct iphdr _iph;
 ip:
                iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
-               if (!iph)
+               if (!iph || !iph->ihl)
                        return false;
 
                if (ip_is_fragment(iph))