Bug 208391
Summary: | CVE-2006-4572 IPv6/IP6Tables Vulnerabilities | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 3 | Reporter: | Marcel Holtmann <holtmann> |
Component: | kernel | Assignee: | Thomas Graf <tgraf> |
Status: | CLOSED NOTABUG | QA Contact: | Brian Brock <bbrock> |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | 3.0 | CC: | davem, petrides, rkhan, security-response-team |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | impact=important,source=kernelsec,reported=20060928,public=20061025 | ||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2006-10-02 12:50:24 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Marcel Holtmann
2006-09-28 11:02:33 UTC
The function ipv6_find_hdr() was first introduced with 2.6.14-rc2 and later updated with 2.6.16-rc1. The code in question before 2.6.14 and so also in the RHEL3 kernel looks like this: /* look for the desired protocol header */ if((ip6info->flags & IP6T_F_PROTO)) { u_int8_t currenthdr = ipv6->nexthdr; struct ipv6_opt_hdr *hdrptr; u_int16_t ptr; /* Header offset in skb */ u_int16_t hdrlen; /* Header */ ptr = IPV6_HDR_LEN; while (ip6t_ext_hdr(currenthdr)) { /* Is there enough space for the next ext header? */ if (skb->len - ptr < IPV6_OPTHDR_LEN) return 0; /* NONE or ESP: there isn't protocol part */ /* If we want to count these packets in '-p all', * we will change the return 0 to 1*/ if ((currenthdr == IPPROTO_NONE) || (currenthdr == IPPROTO_ESP)) return 0; hdrptr = (struct ipv6_opt_hdr *)(skb->data + ptr); /* Size calculation */ if (currenthdr == IPPROTO_FRAGMENT) { hdrlen = 8; } else if (currenthdr == IPPROTO_AH) hdrlen = (hdrptr->hdrlen+2)<<2; else hdrlen = ipv6_optlen(hdrptr); currenthdr = hdrptr->nexthdr; ptr += hdrlen; /* ptr is too large */ if ( ptr > skb->len ) return 0; } /* currenthdr contains the protocol header */ dprintf("Packet protocol %hi ?= %s%hi.\n", currenthdr, ip6info->invflags & IP6T_INV_PROTO ? "!":"", ip6info->proto); if (ip6info->proto == currenthdr) { if(ip6info->invflags & IP6T_INV_PROTO) { return 0; } return 1; } /* We need match for the '-p all', too! */ if ((ip6info->proto != 0) && !(ip6info->invflags & IP6T_INV_PROTO)) return 0; } The attack talks about circumventing the possibly installed DROP rule and make the function return a non-match. RHEL3 doesn't seem to be affected to the fragment rule workaround. |