LwIP is vulnerable to CVE-2004-0230

[tabascoeye]

The TCP processing accepts RST packets which roughly fall into the ACK window instead of only accepting an RST packet if the seqno. is an exact match.

This is not a too big issue because an attacker would still have to guess around before hitting into the window, but it is still not too nice.

Some big players like most Linux distros still did not fix this issue because it is mainly bad for long lasting connections (e.g.BGP routes).

Still, fixing this in LwIP shouldn't be complicated (see the FreeBSD solution) and feasable

[tabascoeye]

Suggested simple fix (also the way FreeBSD fixed it):

If an RST is sent out of sequence, only answer with an ACK and wait for a re-send with the correct seq.no.
That way, the attacker would have to guess the absolute correct seq.no. instead of only hitting inside the receive window.

Change in tcp_inc.c in function tcp_process():

  /* Process incoming RST segments. */
  if (flags & TCP_RST) {
    /* First, determine if the reset is acceptable. */
    if (ackno == pcb->snd_nxt) {
      LWIP_DEBUGF(TCP_INPUT_DEBUG, ("tcp_process: Connection RESET\n"));
      LWIP_ASSERT("tcp_input: pcb->state != CLOSED", pcb->state != CLOSED);
      recv_flags |= TF_RESET;
      pcb->flags &= ~TF_ACK_DELAY;
      return ERR_RST;
    } else {
      LWIP_DEBUGF(TCP_INPUT_DEBUG, ("tcp_process: unacceptable reset seqno %"U32_F" rcv_nxt %"U32_F"\n",
       seqno, pcb->rcv_nxt));
      LWIP_DEBUGF(TCP_DEBUG, ("tcp_process: unacceptable reset seqno %"U32_F" rcv_nxt %"U32_F"\n",
       seqno, pcb->rcv_nxt));
      tcp_ack_now(pcb); //only send an ACK and wait for correct seqno. on RST packet ==> protection against RST spoofing (SVE-2004-0230)
      return ERR_OK;
    }
  }