Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4965 > unrolled thread

DSA for CVE-2016-5696 (off-path blind TCP session attack)

Back to article view | Back to linux.debian.security

Contents

  DSA for CVE-2016-5696 (off-path blind TCP session attack) Richard van den Berg <richard@vdberg.org> - 2016-08-11 15:00 +0200
    Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Salvatore Bonaccorso <carnil@debian.org> - 2016-08-12 17:40 +0200
      Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Jakub Wilk <jwilk@debian.org> - 2016-08-12 17:50 +0200
        Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Clément Hermann <nodens@nodens.org> - 2016-08-12 18:10 +0200
        Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Rick Moen <rick@linuxmafia.com> - 2016-08-12 22:50 +0200
        Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Sam Morris <sam@robots.org.uk> - 2016-08-15 20:50 +0200
          Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Paul Wise <pabs@debian.org> - 2016-08-16 04:30 +0200
          Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Elmar Stellnberger <estellnb@gmail.com> - 2016-08-16 21:40 +0200
            Re: DSA for CVE-2016-5696 (off-path blind TCP session attack) Dylan Frese <dmfrese@gmail.com> - 2016-08-16 21:50 +0200

#4965 — DSA for CVE-2016-5696 (off-path blind TCP session attack)

Dear Debian security team,

Will there be a DSA written for CVE-2016-5696 [1]? It looks pretty 
serious and I'd like to fix this on my systems ASAP.

Kind regards,

Richard van den Berg

[1] https://security-tracker.debian.org/tracker/CVE-2016-5696

[toc] | [next] | [standalone]

#4967

Hi Richard,

On Thu, Aug 11, 2016 at 02:41:29PM +0200, Richard van den Berg wrote:
> Dear Debian security team,
> 
> Will there be a DSA written for CVE-2016-5696 [1]? It looks pretty serious
> and I'd like to fix this on my systems ASAP.

Yes there will be a Linux DSA including the fix for CVE-2016-5696.
There is no timeline though yet, and mitigation could be used as per
https://lwn.net/Articles/696868/ .

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#4968

* Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35:
>mitigation could be used as per https://lwn.net/Articles/696868/ .

This is behind paywall at the moment. The relevant part appears to be:

>there is a mitigation available in the form of the 
>tcp_challenge_ack_limit sysctl knob. Setting that value to something 
>enormous (e.g. 999999999) will make it much harder for attackers to 
>exploit the flaw. 

-- 
Jakub Wilk

[toc] | [prev] | [next] | [standalone]

#4969

Le 12/08/2016 à 17:46, Jakub Wilk a écrit :
> * Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35:
>> mitigation could be used as per https://lwn.net/Articles/696868/ .
>
> This is behind paywall at the moment. The relevant part appears to be:
>
>> there is a mitigation available in the form of the
>> tcp_challenge_ack_limit sysctl knob. Setting that value to something
>> enormous (e.g. 999999999) will make it much harder for attackers to
>> exploit the flaw. 
>

The akamai blog describe the workaround as well [1], you could implement
it with:

|sysctl net.ipv4.tcp_challenge_ack_limit=1073741823; grep -q
tcp_challenge_ack_limit /etc/sysctl.conf /etc/sysctl.d/* || echo
"net.ipv4.tcp_challenge_ack_limit=1073741823" >>
/etc/sysctl.d/cve-2016-5696.conf|


[1]
https://blogs.akamai.com/2016/08/vulnerability-in-the-linux-kernels-tcp-stack-implementation.html

Cheers !

-- 
Clément (nodens)

[toc] | [prev] | [next] | [standalone]

#4971

Quoting Jakub Wilk (jwilk@debian.org):

> * Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35:
> >mitigation could be used as per https://lwn.net/Articles/696868/ .
> 
> This is behind paywall at the moment. The relevant part appears to be:
> 
> >there is a mitigation available in the form of the
> >tcp_challenge_ack_limit sysctl knob. Setting that value to
> >something enormous (e.g. 999999999) will make it much harder for
> >attackers to exploit the flaw.

The passage immediately before that should also be of interest:

  Cao did alert kernel developers to the problem, which was fixed
  (http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758)
  in the mainline in July (and appears in the 4.7 kernel).  The fix raises
  the limit to 1000 challenge ACKs per second, but also adds some
  randomization to the value so that counting will be less effective.  In
  addition, the patch notes per-socket rate-limiting is available, which
  could lead to the removal of the global challenge ACK count down the
  road; some work
  (http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=083ae308280d13d187512b9babe3454342a7987e)
  toward that end has been merged as well.

  The fix has not made it to the stable kernels yet [...].

-- 
Cheers,             Grossman's Law:  "In time of crisis, people do not rise to
Rick Moen           the occasion.  They fall to the level of their training."
rick@linuxmafia.com          http://linuxmafia.com/~rick/lexicon.html#grossman
McQ! (4x80)

[toc] | [prev] | [next] | [standalone]

#4976

On Fri, 12 Aug 2016 17:46:56 +0200, Jakub Wilk wrote:

> * Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35:
>>mitigation could be used as per https://lwn.net/Articles/696868/ .
> 
> This is behind paywall at the moment.

Anyone who wishes to read this may use the following link:

https://lwn.net/SubscriberLink/696868/4d074b4d12dcb3dc/

And if you like the article, consider subscribing to LWN! Now that I 
think about it, I'm pretty sure there's a group membership available to 
all DDs anyway.

-- 
Sam Morris
https://robots.org.uk/
 
PGP: rsa4096/5CDA27B9
CAAA AA1A CA69 A83A 892B  1855 D20B 4202 5CDA 27B9

[toc] | [prev] | [next] | [standalone]

#4977

On Tue, Aug 16, 2016 at 2:42 AM, Sam Morris wrote:

> And if you like the article, consider subscribing to LWN!

Especially since they are in need of new subscribers:

https://lwn.net/Articles/696017/

> I'm pretty sure there's a group membership available to all DDs anyway.

That is for both Debian members and Debian Maintainers:

https://wiki.debian.org/MemberBenefits#LWN

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#4978

Has anyone every thought of an in-path TCP session attack and of 
encrypting sequence numbers by a given secret negotiated in advance 
between both endpoints? If an intelligence service ever wanted to do so 
I guess they could drive an in-path attack against TCP (as they tend to 
sit on the internet backbones everywhere they could easily listen to all 
packets that pass by.).

Am 2016-08-15 um 20:42 schrieb Sam Morris:
> On Fri, 12 Aug 2016 17:46:56 +0200, Jakub Wilk wrote:
>
>> * Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35:
>>> mitigation could be used as per https://lwn.net/Articles/696868/ .
>>
>> This is behind paywall at the moment.
>
> Anyone who wishes to read this may use the following link:
>
> https://lwn.net/SubscriberLink/696868/4d074b4d12dcb3dc/
>
> And if you like the article, consider subscribing to LWN! Now that I
> think about it, I'm pretty sure there's a group membership available to
> all DDs anyway.
>

[toc] | [prev] | [next] | [standalone]

#4979

[Multipart message — attachments visible in raw view] — view raw

An 'in-path' TCP session attack is typically called being
man-in-the-middled or MitM'd. Encrypted and signed transport security
protocols, e.g., SSL, TLS, SSH, thwart this, and prevent guessing a
sequence number from doing anything more than a DoS by resetting the
connection. But someone who's man-in-the-middling you can DoS you anyway,
by just not sending the packets they intercept to their destination.

On Tue, Aug 16, 2016 at 2:33 PM, Elmar Stellnberger <estellnb@gmail.com>
wrote:

> Has anyone every thought of an in-path TCP session attack and of
> encrypting sequence numbers by a given secret negotiated in advance between
> both endpoints? If an intelligence service ever wanted to do so I guess
> they could drive an in-path attack against TCP (as they tend to sit on the
> internet backbones everywhere they could easily listen to all packets that
> pass by.).
>
>
> Am 2016-08-15 um 20:42 schrieb Sam Morris:
>
>> On Fri, 12 Aug 2016 17:46:56 +0200, Jakub Wilk wrote:
>>
>> * Salvatore Bonaccorso <carnil@debian.org>, 2016-08-12, 17:35:
>>>
>>>> mitigation could be used as per https://lwn.net/Articles/696868/ .
>>>>
>>>
>>> This is behind paywall at the moment.
>>>
>>
>> Anyone who wishes to read this may use the following link:
>>
>> https://lwn.net/SubscriberLink/696868/4d074b4d12dcb3dc/
>>
>> And if you like the article, consider subscribing to LWN! Now that I
>> think about it, I'm pretty sure there's a group membership available to
>> all DDs anyway.
>>
>>
>


-- 
OpenPGP Public Key Fingerprint: A1BE CD54 A9B9 ADDB EE8B  35E5 1F6D 61B4
0C5E 2AB

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web