linux-hardened/net
Herbert Xu 2a0a6ebee1 [NETLINK]: Synchronous message processing.
Let's recap the problem.  The current asynchronous netlink kernel
message processing is vulnerable to these attacks:

1) Hit and run: Attacker sends one or more messages and then exits
before they're processed.  This may confuse/disable the next netlink
user that gets the netlink address of the attacker since it may
receive the responses to the attacker's messages.

Proposed solutions:

a) Synchronous processing.
b) Stream mode socket.
c) Restrict/prohibit binding.

2) Starvation: Because various netlink rcv functions were written
to not return until all messages have been processed on a socket,
it is possible for these functions to execute for an arbitrarily
long period of time.  If this is successfully exploited it could
also be used to hold rtnl forever.

Proposed solutions:

a) Synchronous processing.
b) Stream mode socket.

Firstly let's cross off solution c).  It only solves the first
problem and it has user-visible impacts.  In particular, it'll
break user space applications that expect to bind or communicate
with specific netlink addresses (pid's).

So we're left with a choice of synchronous processing versus
SOCK_STREAM for netlink.

For the moment I'm sticking with the synchronous approach as
suggested by Alexey since it's simpler and I'd rather spend
my time working on other things.

However, it does have a number of deficiencies compared to the
stream mode solution:

1) User-space to user-space netlink communication is still vulnerable.

2) Inefficient use of resources.  This is especially true for rtnetlink
since the lock is shared with other users such as networking drivers.
The latter could hold the rtnl while communicating with hardware which
causes the rtnetlink user to wait when it could be doing other things.

3) It is still possible to DoS all netlink users by flooding the kernel
netlink receive queue.  The attacker simply fills the receive socket
with a single netlink message that fills up the entire queue.  The
attacker then continues to call sendmsg with the same message in a loop.

Point 3) can be countered by retransmissions in user-space code, however
it is pretty messy.

In light of these problems (in particular, point 3), we should implement
stream mode netlink at some point.  In the mean time, here is a patch
that implements synchronous processing.  

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-05-03 14:55:09 -07:00
..
802 Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
8021q [PATCH] misc verify_area cleanups 2005-05-01 08:59:08 -07:00
appletalk [ATALK]: Add missing dev_hold() to atrtr_create(). 2005-04-19 22:44:17 -07:00
atm [PATCH] misc verify_area cleanups 2005-05-01 08:59:08 -07:00
ax25 [AX25] Introduce ax25_type_trans 2005-04-24 18:53:06 -07:00
bluetooth [NET]: kill gratitious includes of major.h 2005-04-25 21:40:39 -07:00
bridge [PATCH] kobject/hotplug split - net bridge 2005-04-18 21:57:37 -07:00
core [NETLINK]: Synchronous message processing. 2005-05-03 14:55:09 -07:00
decnet [NETLINK]: Synchronous message processing. 2005-05-03 14:55:09 -07:00
econet Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ethernet Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ipv4 [NETLINK]: Synchronous message processing. 2005-05-03 14:55:09 -07:00
ipv6 [NETLINK]: Synchronous message processing. 2005-05-03 14:55:09 -07:00
ipx Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
irda [PATCH] x86_64: Make IRDA devices are not really ISA devices not depend on CONFIG_ISA 2005-04-16 15:24:56 -07:00
key Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
lapb Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
llc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
netlink [NETLINK]: cb_lock does not needs ref count on sk 2005-05-03 14:43:27 -07:00
netrom Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
packet Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
rose Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
rxrpc Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sched [PKT_SCHED]: HTB: Drop packet when direct queue is full 2005-05-03 14:39:33 -07:00
sctp [SCTP] Fix SCTP sendbuffer accouting. 2005-04-28 12:02:04 -07:00
sunrpc [PATCH] DocBook: changes and extensions to the kernel documentation 2005-05-01 08:59:25 -07:00
unix [NET]: kill gratitious includes of major.h 2005-04-25 21:40:39 -07:00
wanrouter [PATCH] misc verify_area cleanups 2005-05-01 08:59:08 -07:00
x25 Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
xfrm [NETLINK]: Synchronous message processing. 2005-05-03 14:55:09 -07:00
compat.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Kconfig Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
nonet.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
socket.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
sysctl_net.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
TUNABLE Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00