consistently apply ufo or fragmentation in kernel-net-udp CVE-2017-1000112

asked 2017-08-16 01:49:33 +0200

This post is a wiki. Anyone with karma >75 is welcome to improve it.

updated 2017-08-16 01:49:48 +0200

lpr
4819 ●186 ●253 ●257

http://www.uni-tuebingen....

Exploitable memory corruption due to UFO to non-UFO path switch

When iteratively building a UDP datagram with MSG_MORE and that datagram exceeds MTU, consistently choose UFO or fragmentation. Once skb_is_gso, always apply ufo. Conversely, once a datagram is split across multiple skbs, do not consider ufo. Sendpage already maintains the first invariant, only add the second. IPv6 does not have a sendpage implementation to modify. A gso skb must have a partial checksum, do not follow sk_no_check_tx in udp_send_skb. Found by syzkaller. Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach")

Exploitable if unprivileged user namespaces are enabled.

Upstream-Patch is available.

Files affected: kernel-adaptation-sbj-3.4.108.20161101.1/net/ipv4/ip_output.c lines 845-853 (diffs in if() ); 1173-1178 (diffs in 1175-sbj and 1179-sbj )

kernel-adaptation-sbj-3.4.108.20161101.1/ipv4/udp.c lines 736-742 (diff sk->sk_no_check_tx / sk->sk_no_check and UDP_CSUM_NOXMIT)

kernel-adaptation-sbj-3.4.108.20161101.1/net/ipv6/ip6_output.c lines 1338-1345 (diffs in if() and (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk) )