NetBSD Security Advisory 2021-001: Predictable ID disclosures in IPv4 and IPv6
11 March, 2021 by security-officer@netbsd.org | netbsd
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Advisory 2021-001 ================================= Topic: Predictable ID disclosures in IPv4 and IPv6 Version: NetBSD-current: affected NetBSD 9.1: affected NetBSD 8.2: affected Severity: Possible data exfiltration from firewalled or NATed networks Fixed: NetBSD-current: March 9, 2021 NetBSD-9 branch: March 9, 2021 NetBSD-8 branch: March 9, 2021 Please note that NetBSD releases prior to 8.2 are no longer supported. It is recommended that all users upgrade to a supported release. Abstract ======== IP ID randomization was not enabled by default and the randomization algorithms were not strong enough. Technical Details ================= 1. IPv4 and IPv6 fragment ids were not randomly generated by default. Furthermore the randomization algorithms were not strong enough. 2. The TCP ISS random generation had an information leak. 3. The IPv6 flow label generation algorithm was not strong enough. Solutions and Workarounds ========================= For all NetBSD versions, you need to obtain fixed kernel sources, rebuild and install the new kernel, and reboot the system. The following revisions fix the issues: src/sys/netinet/in_var.h 1.99,1.102 src/sys/netinet/ip6.h 1.30 src/sys/netinet/ip_input.c 1.400 src/sys/netinet/tcp_subr.c 1.285,1.286 src/sys/netinet/tcp_timer.c 1.96 src/sys/netinet6/ip6_id.c 1.20 src/sys/netinet6/ip6_var.h 1.88 The fixed source may be obtained from the NetBSD CVS repository. The following instructions briefly summarise how to upgrade your kernel. In these instructions, replace: ARCH with your architecture (from uname -m), and KERNCONF with the name of your kernel configuration file. To update from CVS, re-build, and re-install the kernel: # cd src # cvs update -d -P sys/netinet sys/netinet6 # ./build.sh kernel=KERNCONF # mv /netbsd /netbsd.old # cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd # shutdown -r now For more information on how to do this, see: https://www.NetBSD.org/docs/guide/en/chap-kernel.html Thanks To ========= Amit Klein for reporting these vulnerabilities and Taylor R. Campbell for fixing them. More Information ================ Advisories may be updated as new information becomes available. The most recent version of this advisory (PGP signed) can be found at https://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2021-001.txt.asc Information about NetBSD and NetBSD security can be found at https://www.NetBSD.org/ https://www.NetBSD.org/Security/ Copyright 2021, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. -----BEGIN PGP SIGNATURE----- iQIcBAEBAgAGBQJgSn73AAoJEIkmHhf170n/jpYQAKzk+vo/CDcYchOk+/wgPhBL TbG6rxD3xAVD1aH/sz1lviYTBE5i3W+RohJtZtvUAEoSivFuAODw3TYH/S+KWhDY IyZ1shNICPTqB1dCrgjiQpmOq9fYQ4i0zpGHhvkqWGjWXMnN2nMy37fPvsZ2TvG2 WrwKThptM8Ls6aB+K4Fg0NcHW6ifdvbXY5r2ddXftoT+zsbW9mclfu9spsAHQtLh I11GedEU7BOsvT/woFW6mG3VsHPUXofaC5BTINEiJq1o/VE9HoRmhp05Ik+NCwCv BTzLrKmpOkMJzPp3wvOE2TeolyG57rw1LrHHh6Y/Zb4BIJb6mDP03xuaulRvHg/i D27/p8qvK4lxSVQtwci15TUa45MbW/nAGMgDEPuMHxEAxwqcfZtdlTiCSSSUuVZV BxBaW6hB1gTpkNxmtMt7H0W09xbfgztQndHlZaWv2vTeOlHHKO6298C43g12PS/M pGd3XD3e1hrdrxjtfmiA8oZgOqCM6GJdGpaxE6sBWsVHNyNVurgGI1h5orW9OzO1 vuK6iwq8AZtIp5s/IFddbdFyTNGuzc4gdNx/ON9CnuJRTJ5pWEABYH25imf3fcfU wRqpGwB2oOMdKnQ56o0qMykuSurXbJNM65R3xlijjuZrclt7cr6Kz3uO+zRr0yGM 1MAq4vRQavtS6+04kZiV =Oxq5 -----END PGP SIGNATURE-----