[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 May 2023 20:19:42 +0200
From: Erik Auerswald <auerswal@...x-ag.uni-kl.de>
To: oss-security@...ts.openwall.com
Subject: Re: IPv6 and Route of Death
Hi all,
On Wed, May 17, 2023 at 07:13:51PM +0200, Solar Designer wrote:
> On Wed, May 17, 2023 at 10:02:31AM -0400, Jeffrey Walton wrote:
> > This seems to have been dropped as a 0-day. I have not seen a CVE
> > assigned to it.
>
> The "original writeup" you reference says this is CVE-2023-2156.
>
> > I _think_ this is the original writeup:
> >
> > * https://www.interruptlabs.co.uk//articles/linux-ipv6-route-of-death
It also mentions that "the bug patch didn't solve the underlying problem
(ZDI confirmed this too), so we're still expecting another patch at
some[ ]point."
The Zero Day Initiative (ZDI) entry[0] linked from the article[1]
gives a time line:
01/26/22 – ZDI reported the vulnerability to the vendor.
[...]
04/14/23 – The vendor informed the ZDI that a new patch would merge
into the latest mainline on 04/21/2023.
04/21/23 – The original finder reports to the vendor that the patch
may not work, and it was confirmed by the ZDI that the
vulnerability is reproducible on the latest mainline.
05/02/23 – The ZDI informed the vendor that the case will be published
as a zero-day advisory on 05/04/23, and in coordination with
Red Hat this vulnerability will be assigned CVE-2023-2156.
[0] https://www.zerodayinitiative.com/advisories/ZDI-23-547/
[1] https://www.interruptlabs.co.uk/articles/linux-ipv6-route-of-death
The problem described pertains to handling of IPv6 "RPL Source Routing"
using an IPv6 "Extension Header" of the "Routing Header" variant,
the "RPL Source Route Header" (SRH, Routing Type 3). This header
is described in RFC 6554. The RFC specifies that RPL border routers
"do not allow datagrams already carrying an SRH header to enter or exit
a[n] RPL routing domain."
The informational RFC 9288 recommends that "IPv6 packets with IPv6
Extension Headers (or options) that are not expected to traverse transit
routers should be dropped." This is provided as general advice, not
specific to RPL.
Of course, filtering at the border does not protect against compromised
RPL nodes.
Only systems with enabled RPL functionality seem to be vulnerable (as
far as I understand the report).
The described bug pertains to processing the SRH header at the penultimate
hop.
The described result of exploiting the vulnerability is a kernel panic,
i.e., a remote DoS.
HTH,
Erik
--
A distributed system is one in which the failure of a computer you didn't
even know existed can render your own computer unusable.
-- Leslie Lamport
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
