CVE-2011-2393

Debian Bug report logs - #684072
CVE-2011-2393

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2011-2393

Date: Mon, 06 Aug 2012 20:02:52 +0200

Package: kfreebsd-9
Severity: important
Tags: security

Please see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2393  

I'm not sure if there's an upstream fix in the mean time?

Cheers,
        Moritz

Message #10 received at 684072@bugs.debian.org (full text, mbox, reply):

From: Petr Salinger <Petr.Salinger@seznam.cz>

To: jmm@debian.org, 684072@bugs.debian.org

Cc: control@bugs.debian.org

Subject: CVE-2011-2393: ICMPv6 Router Announcement flooding DoS

Date: Fri, 31 Aug 2012 21:06:35 +0200 (CEST)

forwarded 684072 http://www.freebsd.org/cgi/query-pr.cgi?pr=158726
--

The description of the problem is:

  When flooding the local network with random router advertisements,
  hosts and routers update the network information, consuming all
  available CPU resources, making the systems unusable and unresponsive.

It happens only iff IPv6 autoconfiguration is enabled.
But we have only two choices

a) allow autoconfiguration and trust the network to provide correct input
   for autoconfiguration

b) disable autoconfiguration and configure interface manually

Whether autoconfiguration is enabled is controlled by sysctl.
The pristine FreeBSD have autoconfiguration disabled,
our kernel have it enabled to match Linux kernel behaviour:

kfreebsd-8 (8.0-9) unstable; urgency=low

  [ Aurelien Jarno ]
  * Default to netinet6.ip6.v6only=0 and netinet6.ip6.accept_rtadv=1
    to match the Linux kernel defaults.

 -- Aurelien Jarno <aurel32@debian.org>  Wed, 23 Jun 2010 21:31:54 +0200


What should we do ?

Petr

Message #17 received at 684072@bugs.debian.org (full text, mbox, reply):

From: Steven Chamberlain <steven@pyro.eu.org>

To: Petr Salinger <Petr.Salinger@seznam.cz>, 684072@bugs.debian.org

Cc: "debian-bsd@lists.debian.org" <debian-bsd@lists.debian.org>

Subject: Re: Bug#684072: CVE-2011-2393: ICMPv6 Router Announcement flooding DoS

Date: Fri, 31 Aug 2012 20:46:35 +0100

Hi Petr,

On 31/08/12 20:06, Petr Salinger wrote:
> But we have only two choices
> 
> a) allow autoconfiguration and trust the network to provide correct input
>    for autoconfiguration

These are only accepted link-locally, and if someone can flood the link
layer with bogus rtadv packets they could flood with anything and still
cause a DoS.  What really matters, I think, is that the system doesn't
crash and that _other_ network interfaces still function.

A safe, tunable limit on how many IPs/routes can be configured through
this mechanism seems sensible.

There was a patch proposed in PR/158726, which implements a _global_
limit.  But that still means bogus rtadv's received on one interface
could break autoconfiguration on another;  a per-interface limit would
be the only way to avoid that.


Unless upstream decide on a good way to patch this, we could choose to
ignore the issue (as something that must be handled by the sysadmin if
the situation arises), or:

> b) disable autoconfiguration and configure interface manually

But if someone is already relying on IPv6 autoconfiguration, changing
the default could leave their system inaccessible after a kernel update.

IPv6-only networks might also depend on this feature to perform a
network install.  If it is disabled by default, we ought to provide an
easy way to re-enable it.

And this wouldn't really fix anything anyway;  if someone needs to
enable rtadv on their system they become vulnerable to the same issue again.

Regards,
-- 
Steven Chamberlain
steven@pyro.eu.org

Message #22 received at 684072@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Petr Salinger <Petr.Salinger@seznam.cz>

Cc: jmm@debian.org, 684072@bugs.debian.org, control@bugs.debian.org

Subject: Re: CVE-2011-2393: ICMPv6 Router Announcement flooding DoS

Date: Fri, 7 Sep 2012 18:29:30 +0200

On Fri, Aug 31, 2012 at 09:06:35PM +0200, Petr Salinger wrote:
> forwarded 684072 http://www.freebsd.org/cgi/query-pr.cgi?pr=158726
> --
>
> The description of the problem is:
>
>   When flooding the local network with random router advertisements,
>   hosts and routers update the network information, consuming all
>   available CPU resources, making the systems unusable and unresponsive.
>
> It happens only iff IPv6 autoconfiguration is enabled.
> But we have only two choices
>
> a) allow autoconfiguration and trust the network to provide correct input
>    for autoconfiguration
>
> b) disable autoconfiguration and configure interface manually
>
> Whether autoconfiguration is enabled is controlled by sysctl.
> The pristine FreeBSD have autoconfiguration disabled,
> our kernel have it enabled to match Linux kernel behaviour:
>
> kfreebsd-8 (8.0-9) unstable; urgency=low
>
>   [ Aurelien Jarno ]
>   * Default to netinet6.ip6.v6only=0 and netinet6.ip6.accept_rtadv=1
>     to match the Linux kernel defaults.
>
>  -- Aurelien Jarno <aurel32@debian.org>  Wed, 23 Jun 2010 21:31:54 +0200
>
>
> What should we do ?

What about keeping autoconfig enabled and documenting the potential danger in 
README.Debian (or somewhere similar), so that anyone concerned can disable
it locally?

Cheers,
        Moritz

Message #27 received at 684072@bugs.debian.org (full text, mbox, reply):

From: Steven Chamberlain <steven@pyro.eu.org>

To: 684072@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#684072: CVE-2011-2393: ICMPv6 Router Announcement flooding DoS

Date: Mon, 29 Jul 2013 22:40:02 +0100

On 07/09/12 17:29, Moritz Muehlenhoff wrote:
> What about keeping autoconfig enabled and documenting the potential danger in 
> README.Debian (or somewhere similar), so that anyone concerned can disable
> it locally?

It looks like we have a bigger problem than this:

I was going to simply write instructions on disabling IPv6
autoconfiguration, or how to completely disable IPv6 on an interface.
But when testing it on wheezy, it seems the necessary ifconfig flags are
not working on kfreebsd-amd64 or kfreebsd-i386, at least on 9.0 kernels:

# ifconfig xn0 ifdisabled
ifconfig: ioctl(SIOCGIFINFO_IN6): Invalid argument
# ifconfig xn0 -accept_rtadv
ifconfig: ioctl(SIOCGIFINFO_IN6): Invalid argument

This bug would have to be fixed in stable first.  It looks like kernel
ABI breakage, but at first glance the ioctl looks correct and data
structures the same.

There is a sysctl but by design it only sets a default for interfaces
not 'attached' yet, which is of no help here.  And changing the default
from the bootloader might not work either - a loader tunable for this
wasn't implemented until r253239 (kFreeBSD 9.2).

Regards,
-- 
Steven Chamberlain
steven@pyro.eu.org

Message #32 received at 684072@bugs.debian.org (full text, mbox, reply):

From: Steven Chamberlain <steven@pyro.eu.org>

To: 684072@bugs.debian.org

Subject: Re: Bug#684072: CVE-2011-2393: ICMPv6 Router Announcement flooding DoS

Date: Tue, 30 Jul 2013 00:13:28 +0100

On 29/07/13 22:40, Steven Chamberlain wrote:
> # ifconfig xn0 ifdisabled
> ifconfig: ioctl(SIOCGIFINFO_IN6): Invalid argument
> # ifconfig xn0 -accept_rtadv
> ifconfig: ioctl(SIOCGIFINFO_IN6): Invalid argument

Argh, that needs to be:

# ifconfig xn0 inet6 ifdisabled
# ifconfig xn0 inet6 -accept_rtadv

Then it works fine.

Regards,
-- 
Steven Chamberlain
steven@pyro.eu.org

Message #37 received at 684072-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 531167-done@bugs.debian.org,623217-done@bugs.debian.org,630783-done@bugs.debian.org,651624-done@bugs.debian.org,652448-done@bugs.debian.org,652469-done@bugs.debian.org,658639-done@bugs.debian.org,666729-done@bugs.debian.org,675768-done@bugs.debian.org,677707-done@bugs.debian.org,684072-done@bugs.debian.org,691674-done@bugs.debian.org,691798-done@bugs.debian.org,692080-done@bugs.debian.org,700742-done@bugs.debian.org,702943-done@bugs.debian.org,705126-done@bugs.debian.org,706490-done@bugs.debian.org,708451-done@bugs.debian.org,710959-done@bugs.debian.org,730004-done@bugs.debian.org,731182-done@bugs.debian.org,747983-done@bugs.debian.org,748078-done@bugs.debian.org,750364-done@bugs.debian.org,750493-done@bugs.debian.org,754236-done@bugs.debian.org,754237-done@bugs.debian.org,

Cc: kfreebsd-9@packages.debian.org, kfreebsd-9@packages.qa.debian.org

Subject: Bug#765606: Removed package(s) from unstable

Date: Tue, 21 Oct 2014 11:33:49 +0000

Version: 9.2-2+rm

Dear submitter,

as the package kfreebsd-9 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/765606

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Message #46 received at 684072@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <mgilbert@debian.org>

To: 684072@bugs.debian.org

Subject: re: CVE-2011-2393

Date: Fri, 13 Feb 2015 23:13:29 -0500

control: reopen -1

This was closed with the removal of src:freebsd-9, but there hasn't
been any actual upstream activity and no real details to be found
anywhere, so it is still likely unfixed in kfreebsd-10.

Best wishes,
Mike

Send a report that this bug log contains spam.