[oss-security] CVE-2018-17977: CentOS ipsec remote denial of service vulnerability

[luo]

I just applied for the cve number at https://cveform.mitre.org/. I don't know if it is correct to publish the complete information. Please check the community. This vulnerability is very different. Almost all versions of the kernel will work with the centos desktop version. Memory remote accumulation leads to secure remote denial of service



-------- Forwarding messages --------
From: cve-***@mitre.org
Date: 2018-10-04 11:31:06
To: ***@163.com
Cc: cve-***@mitre.org
Subject: Re: [scr579986] CentOS and IPSec
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

[Suggested description]
The Linux kernel 4.14.67 mishandles certain interaction among XFRM
Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which
allows local users to cause a denial of service (memory consumption
and system hang) by leveraging root access to execute crafted
applications, as demonstrated on CentOS 7.
------------------------------------------
[Additional Information]
ipsec Can cause the
remote memory of the centos desktop version to run out, I tested this
problem with centos6.10 centos7.10 , but the minimal installation
version is not very obvious
1.Compile the kernel and start compiling options
<*> IP:AH transformation
<*> IP:ESP transformation
<*> IP:IPComp transformation
<*> IP:IPsec transport mode
<*> IP:IPsec tunnel mode
<*> IP:IPsec BEET mode
2.Modify the firewall or turn off the firewall to allow the ah
protocol or the esp protocol to pass through the firewall. 3.Run
ah_add on the target machine with root privileges, you need to modify
the inet_addr("127.0.0.1") of line 101 of ah_add.c; it refers to the
local address (the address of the target machine)
https://drive.google.com/file/d/15aIxj_yupCcs7i14AIlE8U2ySfOyovnk/view
4,.Run ipip as an attacker with root privileges,Need to modify the
source address and destination address in the main function, the
destination address refers to the IP address of the target machine
https://drive.google.com/file/d/1_dh_KX0JpJdoWQopN1KWORwJsQlah7Nv/view
5.Running the free command can obviously see the decline in the amount
of memory remaining space.Finally, it may lead to deadlock, shutdown
may be, the centos7 desktop version may be more obvious
Can cause the remote memory of the centos desktop version to run out,
I tested this problem with centos6.10 centos7.10, but the minimal
installation version is not very obvious
And the strange thing is that when I tested ubuntu, there was no such
problem. Basically, most kernel versions can cause this effect.
------------------------------------------
[VulnerabilityType Other]
Memory accumulation, memory application speed exceeds release speed, causing denial of service
------------------------------------------
[Vendor of Product]
CentOS desktop remote denial of service about ipsec
------------------------------------------
[Affected Product Code Base]
CentOS desktop - CentOS desktop6 CentOS desktop7
------------------------------------------
[Affected Component]
Can cause the remote memory of the centos desktop version to run out, I tested this problem with centos6.10 centos7.10,
https://drive.google.com/file/d/1TmOuAV56JiLP_bTnCQIAFVemN9OoDlIa/view?usp=sharing
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Denial of Service]
true
------------------------------------------
[Attack Vectors]
A packet attack opens a secure server that can cause a remote denial of service
------------------------------------------
[Reference]
https://drive.google.com/file/d/1TmOuAV56JiLP_bTnCQIAFVemN9OoDlIa/view?usp=sharing
https://drive.google.com/file/d/1Mjr9Pu_dAjet2Bq_iWCEUIQkUtSTIBVK/view?usp=sharing
https://drive.google.com/file/d/15aIxj_yupCcs7i14AIlE8U2ySfOyovnk/view
https://drive.google.com/file/d/1_dh_KX0JpJdoWQopN1KWORwJsQlah7Nv/view
------------------------------------------
[Discoverer]
360 ESG Codesafe Team luo quan

Use CVE-2018-17977.


- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]

[Solar Designer]

Post by luo
I don't know if it is correct to publish the complete information.

It is. Linking to temporary resources like Google Drive isn't great,
but luckily your message itself includes some detail.

Post by luo

The Linux kernel 4.14.67 mishandles certain interaction among XFRM
Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which
allows local users to cause a denial of service (memory consumption
and system hang) by leveraging root access to execute crafted
applications, as demonstrated on CentOS 7.

Since you say that "leveraging root access to execute crafted
applications" is required, how is this a security issue? Also, since
this setup has to be prepared locally, how is the attack "remote"?

In other words, would a sysadmin plausibly make this kind of custom
local setup, and why? If the answer is no, then I think there's no
security issue here.

Alexander

[luo]

Oh, sorry, maybe I didn't explain it.


I am demonstrating the remote denial of service vulnerability in the centos desktop version of the ipsec feature.Ipsec is currently the most widely used vpn technology, it uses ah protocol or esp protocol to encrypt or authenticate ip packets.


My test is divided into two parts. The first part is to open the ipsec function, which is what ah_add.c does. He didn't do too much, just opened a transfer mode ah protocol, ipsec is divided into ah protocol and esp Protocol, for simplicity, I set the encryption length to 0, which is my only non-mainstream operation.


The second part sends a special ah protocol packet, triggering the delayed release of the skb effect, causing the memory to be released in time, causing accumulation, and finally leading to denial of service.






The purpose of ah_add.c is just to register an IPSec encrypted channel. For simplicity, I set the encryption authentication length to 0.


In theory, as long as the target machine starts the ipsec function and allows ipsec message interaction with the target machine, it can cause the target machine to refuse service by sending a data packet.




Ah_add is just an operation that starts the ipsec service and allows the interaction with the target to be encrypted with a length of 0.

Post by Solar Designer

Post by luo
I don't know if it is correct to publish the complete information.

It is. Linking to temporary resources like Google Drive isn't great,
but luckily your message itself includes some detail.

Post by luo

The Linux kernel 4.14.67 mishandles certain interaction among XFRM
Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which
allows local users to cause a denial of service (memory consumption
and system hang) by leveraging root access to execute crafted
applications, as demonstrated on CentOS 7.

Since you say that "leveraging root access to execute crafted
applications" is required, how is this a security issue? Also, since
this setup has to be prepared locally, how is the attack "remote"?
In other words, would a sysadmin plausibly make this kind of custom
local setup, and why? If the answer is no, then I think there's no
security issue here.
Alexander

[luo]

All security servers and clients need to have the IPSec function enabled, which is what ah_add does, that is to say, all IPSec servers or clients, if you use the desktop version of centos, there will be such a remote denial of service problem.


Oh, sorry, maybe I didn't explain it.

This is the same as what ah_add does. The only difference is that ah_add makes the encryption length 0. This makes it easier for me to write POC. In reality, the longer the encryption length, the more the denial of service will be.In other words, under the real production environment, the ipsec denial service effect will be more obvious.

Post by Solar Designer

Post by luo
I don't know if it is correct to publish the complete information.

It is. Linking to temporary resources like Google Drive isn't great,
but luckily your message itself includes some detail.

Post by luo

The Linux kernel 4.14.67 mishandles certain interaction among XFRM
Netlink messages, IPPROTO_AH packets, and IPPROTO_IP packets, which
allows local users to cause a denial of service (memory consumption
and system hang) by leveraging root access to execute crafted
applications, as demonstrated on CentOS 7.

Since you say that "leveraging root access to execute crafted
applications" is required, how is this a security issue? Also, since
this setup has to be prepared locally, how is the attack "remote"?
In other words, would a sysadmin plausibly make this kind of custom
local setup, and why? If the answer is no, then I think there's no
security issue here.
Alexander