linux/kernel
Herbert Xu 2a0a6ebee1 [NETLINK]: Synchronous message processing.
Let's recap the problem.  The current asynchronous netlink kernel
message processing is vulnerable to these attacks:

1) Hit and run: Attacker sends one or more messages and then exits
before they're processed.  This may confuse/disable the next netlink
user that gets the netlink address of the attacker since it may
receive the responses to the attacker's messages.

Proposed solutions:

a) Synchronous processing.
b) Stream mode socket.
c) Restrict/prohibit binding.

2) Starvation: Because various netlink rcv functions were written
to not return until all messages have been processed on a socket,
it is possible for these functions to execute for an arbitrarily
long period of time.  If this is successfully exploited it could
also be used to hold rtnl forever.

Proposed solutions:

a) Synchronous processing.
b) Stream mode socket.

Firstly let's cross off solution c).  It only solves the first
problem and it has user-visible impacts.  In particular, it'll
break user space applications that expect to bind or communicate
with specific netlink addresses (pid's).

So we're left with a choice of synchronous processing versus
SOCK_STREAM for netlink.

For the moment I'm sticking with the synchronous approach as
suggested by Alexey since it's simpler and I'd rather spend
my time working on other things.

However, it does have a number of deficiencies compared to the
stream mode solution:

1) User-space to user-space netlink communication is still vulnerable.

2) Inefficient use of resources.  This is especially true for rtnetlink
since the lock is shared with other users such as networking drivers.
The latter could hold the rtnl while communicating with hardware which
causes the rtnetlink user to wait when it could be doing other things.

3) It is still possible to DoS all netlink users by flooding the kernel
netlink receive queue.  The attacker simply fills the receive socket
with a single netlink message that fills up the entire queue.  The
attacker then continues to call sendmsg with the same message in a loop.

Point 3) can be countered by retransmissions in user-space code, however
it is pretty messy.

In light of these problems (in particular, point 3), we should implement
stream mode netlink at some point.  In the mean time, here is a patch
that implements synchronous processing.  

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-05-03 14:55:09 -07:00
..
irq Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
power [PATCH] DocBook: changes and extensions to the kernel documentation 2005-05-01 08:59:25 -07:00
acct.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
audit.c [NETLINK]: Synchronous message processing. 2005-05-03 14:55:09 -07:00
auditsc.c [PATCH] SELinux: fix deadlock on dcache lock 2005-04-18 10:47:35 -07:00
capability.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
compat.c [PATCH] Fix get_compat_sigevent() 2005-04-16 15:24:01 -07:00
configs.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
cpu.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
cpuset.c [PATCH] cpuset: remove function attribute const 2005-04-16 15:25:59 -07:00
dma.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
exec_domain.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
exit.c [PATCH] make lots of things static 2005-05-01 08:59:29 -07:00
extable.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
fork.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
futex.c [PATCH] convert that currently tests _NSIG directly to use valid_signal() 2005-05-01 08:59:14 -07:00
intermodule.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
itimer.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kallsyms.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kfifo.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kmod.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kprobes.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
ksysfs.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
kthread.c [PATCH] use smp_mb/wmb/rmb where possible 2005-05-01 08:58:47 -07:00
Makefile Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
module.c [PATCH] Change synchronize_kernel to _rcu and _sched 2005-05-01 08:59:04 -07:00
panic.c [SPARC]: Stop-A printk cleanup 2005-04-24 20:38:02 -07:00
params.c [PATCH] kernel/param.c: don't use .max when .num is NULL in param_array_set() 2005-04-16 15:25:42 -07:00
pid.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
posix-cpu-timers.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
posix-timers.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
printk.c [PATCH] clean up kernel messages 2005-05-01 08:59:02 -07:00
profile.c [PATCH] Change synchronize_kernel to _rcu and _sched 2005-05-01 08:59:04 -07:00
ptrace.c [PATCH] convert that currently tests _NSIG directly to use valid_signal() 2005-05-01 08:59:14 -07:00
rcupdate.c [PATCH] Deprecate synchronize_kernel, GPL replacement 2005-05-01 08:59:04 -07:00
resource.c [PATCH] pci enumeration on ixp2000: overflow in kernel/resource.c 2005-04-16 15:25:58 -07:00
sched.c [PATCH] DocBook: fix some descriptions 2005-05-01 08:59:26 -07:00
seccomp.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
signal.c [PATCH] convert that currently tests _NSIG directly to use valid_signal() 2005-05-01 08:59:14 -07:00
softirq.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
spinlock.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
stop_machine.c [PATCH] use smp_mb/wmb/rmb where possible 2005-05-01 08:58:47 -07:00
sys_ni.c [PATCH] consolidate sys_shmat 2005-05-01 08:59:12 -07:00
sys.c [PATCH] convert that currently tests _NSIG directly to use valid_signal() 2005-05-01 08:59:14 -07:00
sysctl.c [PATCH] DocBook: fix some descriptions 2005-05-01 08:59:26 -07:00
time.c [PATCH] time interpolator: Fix settimeofday inaccuracy 2005-04-28 08:13:58 -07:00
timer.c [PATCH] use smp_mb/wmb/rmb where possible 2005-05-01 08:58:47 -07:00
uid16.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
user.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
wait.c Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
workqueue.c [PATCH] re-export cancel_rearming_delayed_workqueue 2005-04-16 15:23:59 -07:00