This is a note to let you know that I've just added the patch titled ipv6: remove max_addresses check from ipv6_create_tempaddr to the 3.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ipv6-remove-max_addresses-check-from-ipv6_create_tempaddr.patch and it can be found in the queue-3.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 37aef530868d5b0bcd7f3345d044fe0647dfcc8b Mon Sep 17 00:00:00 2001 From: Hannes Frederic Sowa <hannes@xxxxxxxxxxxxxxxxxxx> Date: Fri, 16 Aug 2013 13:02:27 +0200 Subject: ipv6: remove max_addresses check from ipv6_create_tempaddr From: Hannes Frederic Sowa <hannes@xxxxxxxxxxxxxxxxxxx> [ Upstream commit 4b08a8f1bd8cb4541c93ec170027b4d0782dab52 ] Because of the max_addresses check attackers were able to disable privacy extensions on an interface by creating enough autoconfigured addresses: <http://seclists.org/oss-sec/2012/q4/292> But the check is not actually needed: max_addresses protects the kernel to install too many ipv6 addresses on an interface and guards addrconf_prefix_rcv to install further addresses as soon as this limit is reached. We only generate temporary addresses in direct response of a new address showing up. As soon as we filled up the maximum number of addresses of an interface, we stop installing more addresses and thus also stop generating more temp addresses. Even if the attacker tries to generate a lot of temporary addresses by announcing a prefix and removing it again (lifetime == 0) we won't install more temp addresses, because the temporary addresses do count to the maximum number of addresses, thus we would stop installing new autoconfigured addresses when the limit is reached. This patch fixes CVE-2013-0343 (but other layer-2 attacks are still possible). Thanks to Ding Tianhong to bring this topic up again. Signed-off-by: Hannes Frederic Sowa <hannes@xxxxxxxxxxxxxxxxxxx> Cc: Ding Tianhong <dingtianhong@xxxxxxxxxx> Cc: George Kargiotakis <kargig@xxxxxxx> Cc: P J P <ppandit@xxxxxxxxxx> Cc: YOSHIFUJI Hideaki <yoshfuji@xxxxxxxxxxxxxx> Acked-by: Ding Tianhong <dingtianhong@xxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/ipv6/addrconf.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1124,12 +1124,10 @@ retry: if (ifp->flags & IFA_F_OPTIMISTIC) addr_flags |= IFA_F_OPTIMISTIC; - ift = !max_addresses || - ipv6_count_addresses(idev) < max_addresses ? - ipv6_add_addr(idev, &addr, tmp_plen, - ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK, - addr_flags) : NULL; - if (IS_ERR_OR_NULL(ift)) { + ift = ipv6_add_addr(idev, &addr, tmp_plen, + ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK, + addr_flags); + if (IS_ERR(ift)) { in6_ifa_put(ifp); in6_dev_put(idev); pr_info("%s: retry temporary address regeneration\n", __func__); Patches currently in stable-queue which might be from hannes@xxxxxxxxxxxxxxxxxxx are queue-3.10/ipv6-fix-null-pointer-dereference-in-__ip6addrlbl_add.patch queue-3.10/net-bridge-convert-mldv2-query-mrc-into-msecs_to_jiffies-for-max_delay.patch queue-3.10/ipv6-don-t-stop-backtracking-in-fib6_lookup_1-if-subtree-does-not-match.patch queue-3.10/ipv6-don-t-depend-on-per-socket-memory-for-neighbour-discovery-messages.patch queue-3.10/ipv6-remove-max_addresses-check-from-ipv6_create_tempaddr.patch queue-3.10/icmpv6-treat-dest-unreachable-codes-5-and-6-as-eacces-not-eproto.patch queue-3.10/ipv6-drop-packets-with-multiple-fragmentation-headers.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html