Insufficient validation of user-supplied sizes for the MSG_CRYPTO message type
CVE: CVE-2021-43267
Component: kernel
CWE: CWE-20
Severity: Important
CVSS v3: 8.7/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2021-11-02T00:00:00+00:00

A flaw was discovered in the cryptographic receive code in the Linux kernel's implementation of transparent interprocess communication. An attacker, with the ability to send TIPC messages to the target, can corrupt memory and escalate privileges on the target system.

Statement: This issue affects Red Hat Enterprise Linux 8 starting with the kernel that shipped with Red Hat Enterprise Linux 8.4 GA (kernel-4.18.0-305.el8). Previous Red Hat Enterprise Linux 8 kernel versions were not affected as they did not include the vulnerable functionality.

Red Hat recommends to use transport level to separate and/or secure (by both encrypting and authenticating via eg. IPSec/MACSec) the communication between nodes. This limits the exposure of this issue to semi-trusted nodes.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/2974891
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
The TIPC  module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module.

Loading the module can be prevented with the following instructions:
# echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf
The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use.

If the system requires this module to work correctly, this mitigation may not be suitable.
If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec):

- BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION - 

1) On the host, save the following in a file with the ".stp" extension:

%{

#include <linux/skbuff.h>


#define  MSG_CRYPTO           14
#define  SOCK_WAKEUP          14       /* pseudo user */
#define  TOP_SRV              15       /* pseudo user */


struct tipc_msg {
        __be32 hdr[15];
};

static inline struct tipc_msg *buf_msg(struct sk_buff *skb)
{
        return (struct tipc_msg *)skb->data;
}

static inline u32 msg_word(struct tipc_msg *m, u32 pos)
{
        return ntohl(m->hdr[pos]);
}

static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val)
{
        m->hdr[w] = htonl(val);
}

static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask)
{
        return (msg_word(m, w) >> pos) & mask;
}

static inline void msg_set_bits(struct tipc_msg *m, u32 w,
                                u32 pos, u32 mask, u32 val)
{
        val = (val & mask) << pos;
        mask = mask << pos;
        m->hdr[w] &= ~htonl(mask);
        m->hdr[w] |= htonl(val);
}

static inline u32 msg_user(struct tipc_msg *m)
{
        return msg_bits(m, 0, 25, 0xf);
}

static inline void msg_set_user(struct tipc_msg *m, u32 n)
{
        msg_set_bits(m, 0, 25, 0xf, n);
}

%}

function sanitize:long (skb:long) %{
        struct sk_buff *skb;
        struct tipc_msg *hdr;

#if STAP_COMPAT_VERSION >= STAP_VERSION(1,8)
        skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb;
#else
        skb = (struct sk_buff *) (unsigned long) THIS->skb;
#endif

        hdr = buf_msg(skb);

        if(msg_user(hdr) == MSG_CRYPTO) {
                msg_set_user(hdr, TOP_SRV);      // set to invalid in this context
        }

%}

probe module("tipc").function("tipc_data_input").call {
        sanitize($skb);
}


2) Install the "systemtap" package and any required dependencies (such as
   kernel-devel and kernel-debuginfo packages).

3) Run the "stap -g [filename-from-step-1].stp" command as root.

If the host is rebooted, the changes will be lost and the script must be
run again.


Alternatively, build the systemtap script on a development system with
"stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel
module to all affected systems, and run "staprun -L <module>" on those.
When using this approach only systemtap-runtime package is required on the
affected systems. Please notice that the kernel version must be the same across
all systems.