Re: (OT kinda) Newly-discovered TCP flaw

From	Greg Wooledge <wooledg@eeg.ccf.org>
Newsgroups	linux.debian.user
Subject	Re: (OT kinda) Newly-discovered TCP flaw
Date	2016-08-12 17:00 +0200
Message-ID	<s5m6d-2Y8-9@gated-at.bofh.it> (permalink)
References	<s50yK-5KE-21@gated-at.bofh.it> <s5hpT-8r9-19@gated-at.bofh.it> <s5jL3-1y8-1@gated-at.bofh.it> <s5lWx-2UE-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

I did some web surfing when this thread was posted, to try to track
down *which kernel versions* are affected by this TCP security flaw.
I haven't seen this information posted yet.

http://www.cs.ucr.edu/~zhiyunq/pub/sec16_TCP_pure_offpath.pdf says:
"The feature is outlined in RFC 5961, which is implemented faithfully
in Linux kernel version 3.6 from late 2012."

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5696 says:
"net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly
determine the rate of challenge ACK segments, which makes it easier
for man-in-the-middle attackers to hijack TCP sessions via a blind
in-window attack."

So the flaw appears to be in Linux kernels from 3.6 to 4.6 inclusive,
which includes Jessie (3.16) but not Wheezy (3.2) or earlier.
The jessie-backports kernel right now is 4.6, but only for a brief
time.  The last plan I saw was for Stretch to ship with 4.10, which
should include the fix for this flaw.

Now on to the thread:

On Fri, Aug 12, 2016 at 10:42:36AM -0400, rhkramer@gmail.com wrote:
> In the README for sysctl on my wheezy system, it says "configure kernel 
> parameters at runtime".

Not on mine.

greg@remote:~$ grep run /etc/sysctl.d/README.sysctl
greg@remote:~$ 

> I may be having a senior moment, but, atm, I'm not completely sure what 
> runtime means

"At boot time", I would think.  But I don't know where your file actually
came from, so my guesses about the author's intent might be somewhat off.

README.sysctl is short enough to post in its entirety here, so this is
what mine says on a wheezy system:

======================================================================
Kernel system variables configuration files

Files found under the /etc/sysctl.d directory that end with .conf are
parsed within sysctl(8) at boot time.  If you want to set kernel variables
you can either edit /etc/sysctl.conf or make a new file.

The filename isn't important, but don't make it a package name as it may clash
with something the package builder needs later. It must end with .conf though.

My personal preference would be for local system settings to go into
/etc/sysctl.d/local.conf but as long as you follow the rules for the names
of the file, anything will work. See sysctl.conf(8) man page for details
of the format.
======================================================================

Thread

(OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-11 18:00 +0200
  Re: (OT kinda) Newly-discovered TCP flaw Reco <recoverym4n@gmail.com> - 2016-08-11 18:30 +0200
    Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-11 18:50 +0200
      Re: (OT kinda) Newly-discovered TCP flaw Hugo Vanwoerkom <hvw59601@care2.com> - 2016-08-12 23:40 +0200
        Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-13 11:10 +0200
          Re: (OT kinda) Newly-discovered TCP flaw Reco <recoverym4n@gmail.com> - 2016-08-13 11:20 +0200
            Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-13 17:20 +0200
          Re: (OT kinda) Newly-discovered TCP flaw Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-08-13 11:20 +0200
            Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-13 17:20 +0200
        Re: (OT kinda) Newly-discovered TCP flaw Reco <recoverym4n@gmail.com> - 2016-08-13 11:20 +0200
  Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 18:40 +0200
    Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 19:00 +0200
      Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-11 19:30 +0200
    Re: (OT kinda) Newly-discovered TCP flaw Dan Ritter <dsr@randomstring.org> - 2016-08-11 19:00 +0200
    Re: (OT kinda) Newly-discovered TCP flaw Nicolas George <george@nsup.org> - 2016-08-11 19:10 +0200
      Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 20:00 +0200
        Re: (OT kinda) Newly-discovered TCP flaw Doug <dmcgarrett@optonline.net> - 2016-08-11 20:50 +0200
          Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-11 21:10 +0200
            Re: (OT kinda) Newly-discovered TCP flaw Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-11 21:40 +0200
              Re: (OT kinda) Newly-discovered TCP flaw Joe <joe@jretrading.com> - 2016-08-11 22:10 +0200
                Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-11 22:40 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Joe <joe@jretrading.com> - 2016-08-11 22:50 +0200
                Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-12 00:00 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Bob Weber <bobrweber@gmail.com> - 2016-08-12 00:00 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-12 11:00 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 12:00 +0200
                Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-12 12:50 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 13:30 +0200
                Re: (OT kinda) Newly-discovered TCP flaw deloptes <deloptes@gmail.com> - 2016-08-12 22:30 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-12 14:30 +0200
                Re: (OT kinda) Newly-discovered TCP flaw rhkramer@gmail.com - 2016-08-12 16:50 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Greg Wooledge <wooledg@eeg.ccf.org> - 2016-08-12 17:00 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-08-12 17:20 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Greg Wooledge <wooledg@eeg.ccf.org> - 2016-08-12 17:40 +0200
                Re: (OT kinda) Newly-discovered TCP flaw rhkramer@gmail.com - 2016-08-12 17:40 +0200
                Re: (OT kinda) Newly-discovered TCP flaw "John L. Ries" <jries@salford-systems.com> - 2016-08-12 18:40 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Curt <curty@free.fr> - 2016-08-12 18:10 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 18:00 +0200
                The Debian/Ubuntu/Mint installer was Re: (OT kinda) Newly-discovered TCP flaw Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-13 01:10 +0200
                Re: The Debian/Ubuntu/Mint installer was Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-13 05:20 +0200
                Re: The Debian/Ubuntu/Mint installer was Re: (OT kinda) Newly-discovered TCP flaw Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-13 10:50 +0200
                Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 05:00 +0200
              Re: (OT kinda) Newly-discovered TCP flaw Gene Heskett <gheskett@shentel.net> - 2016-08-12 04:50 +0200

csiph-web