Vulnerability: net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 does not properly determine the need for UDP Fragmentation Offload (UFO) processing of small packets after the UFO queueing of a large packet, which allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via network traffic that triggers a large response packet.
Vulnerability ID: CVE-2013-4387
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-10-10
File: net/ipv6/ip6_output.c
Commit message: ipv6: udp packets following an UFO enqueued packet need also be handled by UFO

In the following scenario the socket is corked:
If the first UDP packet is larger then the mtu we try to append it to the
write queue via ip6_ufo_append_data. A following packet, which is smaller
than the mtu would be appended to the already queued up gso-skb via
plain ip6_append_data. This causes random memory corruptions.

In ip6_ufo_append_data we also have to be careful to not queue up the
same skb multiple times. So setup the gso frame only when no first skb
is available.

This also fixes a shortcoming where we add the current packet's length to
cork->length but return early because of a packet > mtu with dontfrag set
(instead of sutracting it again).

Found with trinity.

Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Hannes Frederic Sowa

Vulnerable version (before fix):
 static inline int ip6_ufo_append_data(struct sock *sk, 	 * udp datagram 	 */ 	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) { 		skb = sock_alloc_send_skb(sk, 			hh_len + fragheaderlen + transhdrlen + 20, 			(flags & MSG_DONTWAIT), &err); static inline int ip6_ufo_append_data(struct sock *sk, 		skb->protocol = htons(ETH_P_IPV6); 		skb->ip_summed = CHECKSUM_PARTIAL; 		skb->csum = 0; 	}  	err = skb_append_datato_frags(sk,skb, getfrag, from, 				      (length - transhdrlen)); 	if (!err) { 		struct frag_hdr fhdr;  		/* Specify the length of each IPv6 datagram fragment. 		 * It has to be a multiple of 8. static inline int ip6_ufo_append_data(struct sock *sk, 		ipv6_select_ident(&fhdr, rt); 		skb_shinfo(skb)->ip6_frag_id = fhdr.identification; 		__skb_queue_tail(&sk->sk_write_queue, skb);  		return 0; 	} 	/* There is not enough support do UPD LSO, 	 * so follow normal path 	 */ 	kfree_skb(skb);  	return err; }  static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src, int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, 	 * --yoshfuji 	 */  	cork->length += length; 	if (length > mtu) { 		int proto = sk->sk_protocol; 		if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){ 			ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen); 			return -EMSGSIZE; 		}  		if (proto == IPPROTO_UDP && 		    (rt->dst.dev->features & NETIF_F_UFO)) {  			err = ip6_ufo_append_data(sk, getfrag, from, length, 						  hh_len, fragheaderlen, 						  transhdrlen, mtu, flags, rt); 			if (err) 				goto error; 			return 0; 		} 	}  	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) 		goto alloc_new_skb;  	while (length > 0) {

Fixed version (after fix):
 static inline int ip6_ufo_append_data(struct sock *sk, 	 * udp datagram 	 */ 	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) { 		struct frag_hdr fhdr;  		skb = sock_alloc_send_skb(sk, 			hh_len + fragheaderlen + transhdrlen + 20, 			(flags & MSG_DONTWAIT), &err); static inline int ip6_ufo_append_data(struct sock *sk, 		skb->protocol = htons(ETH_P_IPV6); 		skb->ip_summed = CHECKSUM_PARTIAL; 		skb->csum = 0;  		/* Specify the length of each IPv6 datagram fragment. 		 * It has to be a multiple of 8. static inline int ip6_ufo_append_data(struct sock *sk, 		ipv6_select_ident(&fhdr, rt); 		skb_shinfo(skb)->ip6_frag_id = fhdr.identification; 		__skb_queue_tail(&sk->sk_write_queue, skb); 	}  	return skb_append_datato_frags(sk, skb, getfrag, from, 				       (length - transhdrlen)); }  static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src, int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, 	 * --yoshfuji 	 */  	if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP || 					   sk->sk_protocol == IPPROTO_RAW)) { 		ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen); 		return -EMSGSIZE; 	}  	skb = skb_peek_tail(&sk->sk_write_queue); 	cork->length += length; 	if (((length > mtu) || 	     (skb && skb_is_gso(skb))) && 	    (sk->sk_protocol == IPPROTO_UDP) && 	    (rt->dst.dev->features & NETIF_F_UFO)) { 		err = ip6_ufo_append_data(sk, getfrag, from, length, 					  hh_len, fragheaderlen, 					  transhdrlen, mtu, flags, rt); 		if (err) 			goto error; 		return 0; 	}  	if (!skb) 		goto alloc_new_skb;  	while (length > 0) {

Patch:
patch: @@ -1015,6 +1015,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
 	 * udp datagram
 	 */
 	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
+		struct frag_hdr fhdr;
+
 		skb = sock_alloc_send_skb(sk,
 			hh_len + fragheaderlen + transhdrlen + 20,
 			(flags & MSG_DONTWAIT), &err);
@@ -1036,12 +1038,6 @@ static inline int ip6_ufo_append_data(struct sock *sk,
 		skb->protocol = htons(ETH_P_IPV6);
 		skb->ip_summed = CHECKSUM_PARTIAL;
 		skb->csum = 0;
-	}
-
-	err = skb_append_datato_frags(sk,skb, getfrag, from,
-				      (length - transhdrlen));
-	if (!err) {
-		struct frag_hdr fhdr;
 
 		/* Specify the length of each IPv6 datagram fragment.
 		 * It has to be a multiple of 8.
@@ -1052,15 +1048,10 @@ static inline int ip6_ufo_append_data(struct sock *sk,
 		ipv6_select_ident(&fhdr, rt);
 		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
 		__skb_queue_tail(&sk->sk_write_queue, skb);
-
-		return 0;
 	}
-	/* There is not enough support do UPD LSO,
-	 * so follow normal path
-	 */
-	kfree_skb(skb);
 
-	return err;
+	return skb_append_datato_frags(sk, skb, getfrag, from,
+				       (length - transhdrlen));
 }
 
 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
@@ -1227,27 +1218,27 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 	 * --yoshfuji
 	 */
 
-	cork->length += length;
-	if (length > mtu) {
-		int proto = sk->sk_protocol;
-		if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
-			ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
-			return -EMSGSIZE;
-		}
-
-		if (proto == IPPROTO_UDP &&
-		    (rt->dst.dev->features & NETIF_F_UFO)) {
+	if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
+					   sk->sk_protocol == IPPROTO_RAW)) {
+		ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
+		return -EMSGSIZE;
+	}
 
-			err = ip6_ufo_append_data(sk, getfrag, from, length,
-						  hh_len, fragheaderlen,
-						  transhdrlen, mtu, flags, rt);
-			if (err)
-				goto error;
-			return 0;
-		}
+	skb = skb_peek_tail(&sk->sk_write_queue);
+	cork->length += length;
+	if (((length > mtu) ||
+	     (skb && skb_is_gso(skb))) &&
+	    (sk->sk_protocol == IPPROTO_UDP) &&
+	    (rt->dst.dev->features & NETIF_F_UFO)) {
+		err = ip6_ufo_append_data(sk, getfrag, from, length,
+					  hh_len, fragheaderlen,
+					  transhdrlen, mtu, flags, rt);
+		if (err)
+			goto error;
+		return 0;
 	}
 
-	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+	if (!skb)
 		goto alloc_new_skb;
 
 	while (length > 0) {
path: net/ipv6/ip6_output.c