netdev - Re: [PATCH net] inet: RAW sockets using IPPROTO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260204071809.GA171428@shredder>
Date: Wed, 4 Feb 2026 09:18:09 +0200
From: Ido Schimmel <idosch@...dia.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S . Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Willem de Bruijn <willemb@...gle.com>, netdev@...r.kernel.org,
	eric.dumazet@...il.com,
	Yizhou Zhao <zhaoyz24@...ls.tsinghua.edu.cn>,
	David Ahern <dsahern@...nel.org>
Subject: Re: [PATCH net] inet: RAW sockets using IPPROTO_RAW MUST drop
 incoming ICMP

On Tue, Feb 03, 2026 at 07:25:09PM +0000, Eric Dumazet wrote:
> Yizhou Zhao reported that simply having one RAW socket on protocol
> IPPROTO_RAW (255) was dangerous.
> 
>   socket(AF_INET, SOCK_RAW, 255);
> 
> A malicious incoming ICMP packet can set the protocol field to 255
> and match this socket, leading to FNHE cache changes.
> 
> inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST")
> pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner
> 
> "man 7 raw" states:
> 
>   A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able
>   to send any IP protocol that is specified in the passed header.
>   Receiving of all IP protocols via IPPROTO_RAW is not possible
>   using raw sockets.
> 
> Make sure we drop these malicious packets.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Yizhou Zhao <zhaoyz24@...ls.tsinghua.edu.cn>
> Link: https://lore.kernel.org/netdev/20251109134600.292125-1-zhaoyz24@mails.tsinghua.edu.cn/
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>

Reviewed-by: Ido Schimmel <idosch@...dia.com>