[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1344010022.4642.170.camel@deadeye.wl.decadent.org.uk>
Date: Fri, 3 Aug 2012 17:07:02 +0100
From: Ben Hutchings <bhutchings@...arflare.com>
To: <oss-security@...ts.openwall.com>
CC: linux-net-drivers <linux-net-drivers@...arflare.com>
Subject: Remote DoS in Linux sfc driver through TCP MSS option
(CVE-2012-3412)
Issue
-----
On Linux, a peer (or local user) may cause TCP to use a nominal MSS of
as little as 88 (actual MSS of 76 with timestamps). Given that we have
a sufficiently prodigious local sender and the peer ACKs quickly enough,
it is nevertheless possible to grow the window for such a connection
to the point that we will try to send just under 64K at once. This
results in a single skb that expands to 861 segments.
In the sfc driver, such an skb will require hundreds of DMA descriptors;
a substantial fraction of a TX ring or even more than a full ring. The
TX queue selected for the skb may stall and trigger the TX watchdog
repeatedly (since the problem skb will be retried after the TX reset).
Fix
---
This issue is fixed in David Miller's net.git repository by the
following commits:
30b678d net: Allow driver to limit number of GSO segments per skb
7e6d06f sfc: Fix maximum number of TSO segments and minimum TX queue size
1485348 tcp: Apply device TSO segment limit earlier
The out-of-tree sfc driver, available from
<https://support.solarflare.com>, was fixed in a different way (not
dependent on kernel changes) in version 3.2.1.6099.
The OpenOnload package, available from
<http://www.openonload.org/download.html>, was updated to include the
fixed sfc driver in version 201205-u1.
The fixed sfc driver will be included in a new EnterpriseOnload release
shortly.
Mitigation
----------
If all processes that may send on the sfc interface use Onload, or do
not use TCP, the vulnerability does not exist.
The vulnerability can otherwise be avoided by making a temporary
configuration change. For an sfc interface named eth0, either:
a. Increase the TX queue size:
ethtool -G eth0 tx 4096
This can increase TX latency and memory usage.
or:
b. Disable TSO:
ethtool -K eth0 tso off
This can reduce TX throughput and/or increase CPU usage.
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
