Executive Summary

This vulnerability in the Linux kernel involves the IPv4 options Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR). Previously, unprivileged users could set these IP options, which allow packets to be routed through specific nodes.

The vulnerability is that unprivileged applications could exploit this to force packets to route through attacker-controlled nodes, potentially leaking TCP Initial Sequence Numbers (ISN) and other protocol information.

The patch restricts setting these options only to users with the CAP_NET_RAW capability, preventing unprivileged users from abusing these options.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to force network packets to pass through nodes they control, which can lead to leakage of sensitive TCP protocol information such as Initial Sequence Numbers.

This information leakage could be used to facilitate further attacks on network communications, potentially compromising confidentiality and integrity of data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that only users with the CAP_NET_RAW capability can set the Loose Source and Record Route (LSRR) and Strict Source and Record Route (SSRR) IP options.

Additionally, consider filtering or dropping IPv4 packets containing LSRR and SSRR options in your network, as recommended by RFC 7126.

Useful 0 Not Useful 0