Linux Kernel IPv4 LSRR/SSRR Option Privilege Restriction

Detection Guidance

This vulnerability involves the use of IPv4 Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options by unprivileged users. Detection can focus on identifying packets with these IP options on your network or system.

Since LSRR and SSRR options are often filtered but may still be forwarded in some environments, monitoring network traffic for these options can help detect potential exploitation attempts.

You can use packet capture tools like tcpdump or Wireshark to detect packets containing LSRR or SSRR options.

• Using tcpdump to capture packets with LSRR or SSRR options: tcpdump -vvv 'ip[20] & 0x83 != 0'
• Using Wireshark, apply a display filter for IPv4 options: ip.options && (ip.options == 131 || ip.options == 137)

Additionally, checking system capabilities to ensure that only privileged users have CAP_NET_RAW capability can help mitigate the vulnerability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability in the Linux kernel involves the IPv4 options Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR). Previously, unprivileged users could set these IP options, which allow packets to be routed through specific nodes.

The vulnerability is that unprivileged applications could exploit this to force packets to route through attacker-controlled nodes, potentially leaking TCP Initial Sequence Numbers (ISN) and other protocol information.

The patch restricts setting these options only to users with the CAP_NET_RAW capability, preventing unprivileged users from abusing these options.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to force network packets to pass through nodes they control, which can lead to leakage of sensitive TCP protocol information such as Initial Sequence Numbers.

This information leakage could be used to facilitate further attacks on network communications, potentially compromising confidentiality and integrity of data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that only users with the CAP_NET_RAW capability can set the Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options.

Additionally, consider filtering or dropping IPv4 packets containing LSRR and SSRR options in your network, as recommended by RFC 7126.

Useful 0 Not Useful 0