oss-security - CVE Request: another recursion in GRE

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161013161041.GR25134@suse.de>
Date: Thu, 13 Oct 2016 18:10:41 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>,
	cve-assign@...re.org
Subject: CVE Request: another recursion in GRE

Hi,

While debugging the issue CVE-2016-7039, SUSE engineer Michal Kubecek also spotted
a similar problem fixed earlier this year.

If a packet has the layout: | IPv4 header | GRE header | IPv4 header | GRE header | ...
depending on left over stack it could run the kernel out of stack due to
recursion and so crash the kernel.
This might be hard to hit with regular Ethernet MTUs, but easier with Jumbo frames.

Michal has a testcase in 
https://bugzilla.suse.com/show_bug.cgi?id=1001486#c5


As far as I see fixed in 4.6, introduced in 3.13 (bf5a755f).

commit fac8e0f579695a3ecbc4d3cac369139d7f819971
Author: Jesse Gross <jesse@...nel.org>
Date:   Sat Mar 19 09:32:01 2016 -0700

    tunnels: Don't apply GRO to multiple layers of encapsulation.
    
    When drivers express support for TSO of encapsulated packets, they
    only mean that they can do it for one layer of encapsulation.
    Supporting additional levels would mean updating, at a minimum,
    more IP length fields and they are unaware of this.
    
    No encapsulation device expresses support for handling offloaded
    encapsulated packets, so we won't generate these types of frames
    in the transmit path. However, GRO doesn't have a check for
    multiple levels of encapsulation and will attempt to build them.
    
    UDP tunnel GRO actually does prevent this situation but it only
    handles multiple UDP tunnels stacked on top of each other. This
    generalizes that solution to prevent any kind of tunnel stacking
    that would cause problems.
    
    Fixes: bf5a755f ("net-gre-gro: Add GRE support to the GRO stack")
    Signed-off-by: Jesse Gross <jesse@...nel.org>
    Signed-off-by: David S. Miller <davem@...emloft.net>

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.