Slashdot Mirror
TCP Flaw Lets Remote Attackers Stall Devices With Tiny DoS Attack (zdnet.com)
An anonymous reader quotes a report from ZDNet: Security researchers are warning Linux system users of a bug in the Linux kernel version 4.9 and up that could be used to hit systems with a denial-of-service attack on networking kit. The warning comes from Carnegie Mellon University's CERT/CC, which notes that newer versions of the Linux kernel can be "forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (DoS)".
It lists a number of network-equipment vendors, PC and server manufacturers, mobile vendors, and operating-system makers that may be affected but notes that it hasn't confirmed whether any of them actually are. But, given the widespread use of Linux, the bug could affect every vendor from Amazon and Apple through to Ubuntu and ZyXEL. A remote attacker could cause a DoS by sending specially modified packets within ongoing TCP sessions. But sustaining the DoS condition would mean an attacker needs to have continuous two-way TCP sessions to a reachable and open port. The bug, dubbed "SegmentSmack" by Red Hat, has "no effective workaround/mitigation besides a fixed kernel."
It lists a number of network-equipment vendors, PC and server manufacturers, mobile vendors, and operating-system makers that may be affected but notes that it hasn't confirmed whether any of them actually are. But, given the widespread use of Linux, the bug could affect every vendor from Amazon and Apple through to Ubuntu and ZyXEL. A remote attacker could cause a DoS by sending specially modified packets within ongoing TCP sessions. But sustaining the DoS condition would mean an attacker needs to have continuous two-way TCP sessions to a reachable and open port. The bug, dubbed "SegmentSmack" by Red Hat, has "no effective workaround/mitigation besides a fixed kernel."
ping on my DAMN balls
SYN
ACK
SYN/ACK
suck: my DAMN balls
ACK
awwwwwwww yeahhhhhhhhhhh
RST
It ain't pretty TCP over that other stall.
Hold me closer, Tiny DoSser...
Count the packets on the (information super) highway,
Lay me down with TCP calls,
You've had a busy day today.
#DeleteChrome
I like Linux, if I hadn’t grew up on Windows I probably would use it more. Everything has flaws, its going to happen. Anyone who thinks something is perfect is lying.
Users are bending over and preparing for an "exploit".
Which Apple devices use a Linux kernel?
The summary seems to suggest the TCP issue is primarily a Linux bug, but the FreeBSD team fixed this same issue earlier in the week. The bug is not limited to one kernel.
The attacker must keep an open session, so the DoS goes both ways keeping both sides busy. It reminds me of yesterday's story of including bugs on purpose to distract your attackers. I'm just joking, but imagine if the bug was on purpose to DoS the attackers. :)
He's buying thousands of old iPhone 2's to build a supercomputer to avoid embargoes.
Did the find a flaw in the Transmission Control Protocol? Or in the Linux implementation of same? In the latter case, that's a Linux bug, not TCP.
In Soviet Washington the swamp drains you.
I'm confused by this as I can't find any reference to the exploit itself?? Everything is regurgitated from the CVE itself which has no details... From what I gather this attack may have resurfaced in 4.9, but it's certainly not new. We were getting hit with this on IRC servers years ago. Also think this is being blown quite out of proportion since services should have countermeasures in place already by way of _basic_ timeouts.
tl;dr - Bad guys hide on the Internet and security vendors sell fear.
This is unpossible! Teh loonix is perfect and never has problems like this!
Not sure why the editors didn't include the actual patch or technical details, but here's the thread. Click "Related" at the top to see the 5-part patch.
In short, looking at the patch, the DOS attacks the sequence/buffer for reordering TCP packets. Specifically, after sending lots of tiny packets with out of order sequence numbers, a couple things happen:
(1) There is an expensive operation to coalesce adjacent packets. This has to run through the entire out of order RB tree, and generally sucks. The fix avoids doing this until the OOO buffer is almost entirely full.
(2) When doing the collapse, keep track of how many 'tiny' packets there are and just bail out rather than continuing to do lots of operations/copies attempting to coalesce them.
(3) Once you've filled up the entire OOO buffer, Linux only drops just enough older packets to get under the boundary. This exacerbates the previous issues, as the attacker can keep the buffer entirely full. The patch changes this always drop in batches (1/8th of the memory) each time it's full.
Neat patch. Editors, next time can we get some real analysis?
You probably should have read the next two words, instead of just stopping at "4.9".
The "Solaris slinger"
Only 19 months for all those eyes looking at the open source to find it. Not too bad.
And you had an update few days ago. Aren't you checking for updates and read their changelogs? Tsk tsk tsk. BAD user, you. USN-3732-1. Fixed.
Print hot butter into your switch Port can also create a DDOS -like affect on anything plugged into it.
ALERT! Get CERT! Butter has a networking "flaw".
Linux kernel version 4.9 and up
It would be really useful to know which exact vanilla kernel versions are affected, like. up to 4.9.xxx, up to 4.14.yyy, , up to 4.17.zzz or at least "fixed in version 4.17.zzz". Distros that backport network patches will mean that that distros older than 4.9 could still be affected. Is there an informational page that actually helps people determine if they are affected, given their current vanilla kernel version or distro version?
2018: Year of the Linux DoSTop! :-)
Only impacts DOS 6.22