Security [LWN.net]

The netfilter packet of death

Adam Osuchowski and Tomasz Dubinski have sent out an advisory regarding a new vulnerability in the 2.6 netfilter subsystem. Netfilter, being the Linux firewalling code, inspects network packets and makes decisions on which ones to pass on. Use of netfilter is supposed to increase security, so it is always discouraging when the opposite happens. Fortunately, the number of sites vulnerable to this particular bug should be fairly small.

TCP packets can contain an "options" field within the header. This field allows TCP implementations to change how the protocol works; options can be used to turn on features like selective acknowledgments, change how checksumming is done, and so on. Each option has a simple format:

Number Length 'Length' bytes of data

Multiple options can be packed into the field; an option number of zero terminates the list. If netfilter is asked to filter packets based on the contents of the TCP options field, it goes into a loop stepping through each option present in a packet. Unfortunately, it treats the length byte as a signed quantity; the result is that, with an option number greater than 128, netfilter's index into the options field can be pushed backward, and the code can end up in an infinite loop. That tends to slow packet delivery somewhat.

The fix is straightforward: declare the options array as unsigned.

The good news is that, in all likelihood, very few firewalls filter on the TCP options field, and, of those, most have probably not yet been upgraded to 2.6. The bad news is that there are almost certainly many other bugs in the kernel (and elsewhere) caused by confusion between signed and unsigned types. These vulnerabilities can be hard to find without detailed, tedious auditing. And some of them, certainly, will have a larger impact than this one.

Comments (10 posted)

The U.S. Constitution locked up

As seen in Lawrence Lessig's weblog: Amazon.com is offering an electronic version of the U.S. Constitution aimed at Microsoft's reader. It's all nicely equipped with the usual digital rights management stuff; according to Amazon, permission to print the Constitution has been denied.

The irony of the situation is self-evident. We at LWN would certainly never want to INDUCE anybody to commit a crime, but... if somebody were to get around the DRM and dump a copy of this electronic book onto their printer, it would be a clear violation of the DMCA. For somebody looking for a day in court, it would be harder to find a more desirable case to defend than being charged with printing the U.S. Constitution. Explaining the problems of U.S. copyright law to otherwise uninterested parties has always been a challenge; given enough products like this one, that task is likely to get easier.

Comments (8 posted)

New vulnerabilities

Apache: denial of service

Package(s):

apache2

CVE #(s):

CAN-2004-0493

Created:

June 30, 2004

Updated:

July 19, 2004

Description:

Versions of apache 2.0 through 2.0.49 fail to defend against arbitrarily long header lines; this bug can be exploited to cause the server to use arbitrarily large amounts of memory. See this advisory from Georgi Guninski for details.

Alerts:

Fedora	FEDORA-2004-204	2004-07-19
Fedora	FEDORA-2004-203	2004-07-19
Red Hat	RHSA-2004:342-01	2004-07-06
Gentoo	200407-03	2004-07-04
tinysofa	TSSA-2004-012	2004-06-29
Mandrake	MDKSA-2004:064	2004-06-29