netdev - Re: Bug#855153: linux-image-4.9.0-1-amd64: kernel 4.9 does not check route protocol when deleting ipv6 routes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1487098964.2900.89.camel@decadent.org.uk>
Date:   Tue, 14 Feb 2017 19:02:44 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     David Miller <davem@...emloft.net>
Cc:     Pascal Mathis <debian@....smx.li>, 855153@...s.debian.org,
        netdev <netdev@...r.kernel.org>, stable <stable@...r.kernel.org>
Subject: Re: Bug#855153: linux-image-4.9.0-1-amd64: kernel 4.9 does not
 check route protocol when deleting ipv6 routes

Please queue up:

commit c2ed1880fd61a998e3ce40254a99a2ad000f1a7d
Author: Mantas M <grawity@...il.com>
Date:   Fri Dec 16 10:30:59 2016 +0200

    net: ipv6: check route protocol when deleting routes

for stable.

Ben.

On Tue, 2017-02-14 at 19:52 +0100, Pascal Mathis wrote:
> Package: src:linux
> Version: 4.9.6-3
> Severity: important
> Tags: ipv6
> 
> Dear Debian Kernel Maintainers,
> 
> when trying to delete an IPv6 route with a specific route protocol field
> in a kernel 4.9, the kernel does not actually check the protocol of the
> route and just deletes all the routes that match the other attributes.
> 
> This leads to various issues with routing daemons, for example BIRD.
> E.g. when a BGP withdraw update is being received with a prefix matching
> a kernel route, both "proto bird" and "proto kernel" get deleted.
> 
> The only workaround is currently to maintain a manual blacklist in the
> routing daemon, however a proper fix at kernel level would be definitely
> appreciated. As a patch was already committed to the Linux Kernel Git
> Repository, I recommend backporting into the Debian Stretch kernel, as
> the patch is both overseeable and easy to implement.
> 
> The bug itself can be easily reproduced on any Linux running kernel
> version 4.9 or lower by executing these commands:
> 
> ~$ ip -6 route add ff::/64 dev eth0 proto kernel
> ~$ ip -6 route
> (check the routing table, the newly added route is visible)
> ~$ ip -6 route del ff::/64 proto boot
> ~$ ip -6 route
> (the route is gone, although it should still be there!)
> 
> A link to the Git commit fixing this specific issue can be found at the
> following URL and was already merged into kernel 4.10 since rc1:
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c2ed1880fd61a998e3ce40254a99a2ad000f1a7d
[...]

-- 
Ben Hutchings
Reality is just a crutch for people who can't handle science fiction.


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)