netdev - RE: [net-next PATCH 1/4] Revert "inet: limit length of fragment queue hash table bucket lists"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 25 Apr 2013 14:58:54 +0100
From:	"David Laight" <David.Laight@...LAB.COM>
To:	"Jesper Dangaard Brouer" <brouer@...hat.com>,
	"Eric Dumazet" <eric.dumazet@...il.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	"Hannes Frederic Sowa" <hannes@...essinduktion.org>,
	<netdev@...r.kernel.org>
Subject: RE: [net-next PATCH 1/4] Revert "inet: limit length of fragment queue hash table bucket lists"

> The reason this is inevitable, is the attackers invalid fragments will
> never finish (timeout 30 sec), while valid fragments will complete and
> "exit" the queue, thus the end result is hash bucket is filled with
> attackers invalid/incomplete fragments.  IMHO this is a very dangerous
> "feature" to support.

If you are being attacked, the hash buckets will immediately
be filled with invalid packets, no valid packets will enter.
If you delete old entries to add new ones then any valid
packet will soon be flushed out by invalid ones.
The only time you'll manage to assemble anything is if
the valid fragments arrive 'back to back'.

The only hope is to part-decode initial fragments and decide
whether they are valid.

	David