Please sign in to comment.
tcp: should drop incoming frames without ACK flag set
In commit 96e0bf4 (tcp: Discard segments that ack data not yet sent) John Dykstra enforced a check against ack sequences. In commit 354e4aa (tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation) I added more safety tests. But we missed fact that these tests are not performed if ACK bit is not set. RFC 793 3.9 mandates TCP should drop a frame without ACK flag set. " fifth check the ACK field, if the ACK bit is off drop the segment and return" Not doing so permits an attacker to only guess an acceptable sequence number, evading stronger checks. Many thanks to Zhiyun Qian for bringing this issue to our attention. See : http://web.eecs.umich.edu/~zhiyunq/pub/ccs12_TCP_sequence_number_inference.pdf Reported-by: Zhiyun Qian <firstname.lastname@example.org> Signed-off-by: Eric Dumazet <email@example.com> Cc: Nandita Dukkipati <firstname.lastname@example.org> Cc: Neal Cardwell <email@example.com> Cc: John Dykstra <firstname.lastname@example.org> Signed-off-by: David S. Miller <email@example.com>
- Loading branch information...