Allele Security Intelligence - ASA-2019-00412 – Linux kernel: Kernel address disclosure through Internet Protocol Identification (IPID) values

Allele Security Alert

ASA-2019-00412

Identifier(s)

ASA-2019-00412, CVE-2019-10639

Title

Kernel address disclosure through Internet Protocol Identification (IPID) values

Vendor(s)

Linux foundation

Product(s)

Linux kernel

Affected version(s)

Linux kernel versions before 5.1

Linux kernel versions 5.0.x before 5.0.8
Linux kernel versions 4.19.x before 4.19.35
Linux kernel versions 4.14.x before 4.14.112
Linux kernel versions 4.9.x before 4.9.169
Linux kernel versions 4.4.x before 4.4.179
Linux kernel versions 3.18.x before 3.18.139
Linux kernel versions 3.16.x before 3.16.67

Linux kernel versions with the following commit applied:

netns: introduce the net_hash_mix “salt” for hashes
https://github.com/torvalds/linux/commit/0b4419162aa6c4204843f3a13b48d9ab821d3167

Fixed version(s)

Linux kernel version 5.1

Linux kernel version 5.0.8
Linux kernel version 4.19.35
Linux kernel version 4.14.112
Linux kernel version 4.9.169
Linux kernel version 4.4.179
Linux kernel version 3.18.139
Linux kernel version 3.16.67

Linux kernel versions with the following commit applied:

netns: provide pure entropy for net_hash_mix()
https://github.com/torvalds/linux/commit/355b98553789b646ed97ad801a619ff898471b92

Proof of concept

Unknown

Description

A flaw was found in the way the Linux kernel derived the IP ID field from a partial kernel space address returned by a net_hash_mix() function. A remote user could observe this IP ID field to extract the kernel address bits used to derive its value, which may result in leaking the hash key and potentially defeating Kernel Address Space Layout Randomization (KASLR).

Technical details

It is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker’s web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.