[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <54412F9A.9050304@redhat.com>
Date: Fri, 17 Oct 2014 17:02:50 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Connected UDP sockets and kernel queuing (CVE-2014-6512)
I noticed a potential issue with connected UDP sockets and the kernel
kernel per-socket packet queue, potentially leading to IP spoofing
vulnerabilities in the sense that the application thinks the packet came
from host A, but it really came from host B:
<https://bugzilla.redhat.com/show_bug.cgi?id=1071210>
OpenJDK is particularly exposed because DatagramSocket.disconnect()
calls connect(2) with AF_UNSPEC (or a NULL socket address on some
systems) to disconnect sockets, which is a rarely used feature of the
BSD sockets API. OpenJDK ensures that these disconnected sockets remain
bound to a port, so it was possible to enqueue packets whose source
address will not be checked, without even having a tight race to win.
We thought briefly about fixing this in the kernel, but thought better
of it because of backwards compatibility concerns (and we would have to
patch OpenJDK nevertheless). The OpenJDK fix simply checks the source
address of incoming packets. Oracle's fix has an optimization that
drops this additional filter after the maximum amount of pending packets
has been consumed from the socket; my patch moved the filter to native
code instead and applied it to every packet on a connected socket. I
think both approaches are valid.
I'm sharing this with a wider audience because in theory, other
UDP-based services could be affected, although I didn't spot any when I
looked at this prior to disclosure.
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
