Date: Thu, 19 Feb 2004 01:34:34 +0100 From: Andre Oppermann <andre@freebsd.org> To: "Jacques A. Vidrine" <nectar@FreeBSD.org> Cc: freebsd-net@freebsd.org Subject: Re: Fwd: [is this mbuf problem real?] Message-ID: <4034049A.906ACDB9@freebsd.org> References: <20040218220230.GF47727@madman.celabo.org>
next in thread | previous in thread | raw e-mail | index | archive | help
"Jacques A. Vidrine" wrote: > > Does anyone have time to investigate? I will try to get more > information from iDEFENSE. Looking at the code there are indeed some problems. - there seems to be no boundary on how many segments we keep in the tcp reassembly queue - there seems to be no timeout of overaged fragments (we can drop the segments after 1*msl because we don't have SACK and it has to be retransmitted anyway since not ACK'ed which happens after read from userland). Possibly it can be dropped earlier after we've got x bytes or packets of more segments since it is un- likely to receive the missing packet this late except for really massive reordering - this attack can be made with small packets which consume an mbuf cluster anyway For IP packet reassembly we have global and local limits: net.inet.ip.maxfragpackets: 800 net.inet.ip.maxfragsperpacket: 16 Something like this is needed for TCP as well to cope with this kind of resource exhaustion attack. I can fix this stuff but I won't be able to do that in emergency mode. The first code can be ready after the weekend. If someone else wants to takle it earlier/faster tell me. -- Andre > Cheers, > -- > Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org > > ----- Forwarded message from Baby Peanut <baby_p_nut2@yahoo.com> ----- > > Date: Wed, 18 Feb 2004 06:21:25 -0800 (PST) > From: Baby Peanut <baby_p_nut2@yahoo.com> > To: freebsd-security@freebsd.org > Subject: is this mbuf problem real? > Message-ID: <20040218142125.49433.qmail@web41902.mail.yahoo.com> > > BM_207650 > MEDIUM > Vulnerability > Version: 1 2/18/2004@03:47:29 GMT > Initial report > <https://ialert.idefense.com/KODetails.jhtml?irId=207650>; > ID#207650: > FreeBSD Memory Buffer Exhaustion Denial of Service Vulnerability > (iDEFENSE Exclusive): Remote exploitation of a denial of service (DoS) > vulnerability in FreeBSD's memory buffers (mbufs) could allow attackers > to launch a DoS attack. > > By sending many out-of-sequence packets, a low bandwidth denial of > service attack is possible against FreeBSD. When the targeted system > runs out of memory buffers (mbufs), it is no longer able to accept or > create new connections. > > Analysis: (iDEFENSE US) Exploitation of this vulnerability requires > that the targeted system has at least one open TCP port. > > The DoS will last until the port is closed, either by the attacker or > the target machine. > > Detection: iDEFENSE has confirmed this vulnerability exists in FreeBSD > 5.1 (default install from media). It is expected that it also exists > in earlier versions. > > Exploit: iDEFENSE has proof of concept exploit code demonstrating the > impact of this vulnerability. > > Vulnerability Types: Design Error - Denial of Service > Prevalence and Popularity: Almost always > Evidence of Active Exploitation or Probing: No known exploitation or > spike in probing > Ease of Exploitation: Remotely Exploitable > Existence and Availability of Exploit Code: An Exploit exists and is > closely traded. > Vulnerability Consequence: Availability > > __________________________________ > Do you Yahoo!? > Yahoo! Mail SpamGuard - Read only the mail you want. > http://antispam.yahoo.com/tools > _______________________________________________ > freebsd-security@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-security > To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" > > ----- End forwarded message ----- > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4034049A.906ACDB9>