Bug 8284

Reply-To: akpm@linux-foundation.org

On Fri, 30 Mar 2007 01:06:17 -0700 bugme-daemon@bugzilla.kernel.org wrote:

> http://bugzilla.kernel.org/show_bug.cgi?id=8284
> 
>            Summary: IPsec anti-replay window management flaw
>     Kernel Version: 2.6.20.4
>             Status: NEW
>           Severity: normal
>              Owner: shemminger@osdl.org
>          Submitter: didier.schrapf@alcatelaleniaspace.com
> 
> 
> The IPsec ESP/AH anti-replay window size is configurable, 64 being the value 
> recommended by RFC 2406.
> Linux kernels use a 32 bit bitmap to check whether a sequence number has 
> already been received.
> 
> When a packet is received, if its seq is lower than the greatest received seq,
> and if the difference is greater than 32, the check doesn't work.
> This constitutes a security flaw.
> 
> The faulty code is in net/xfrm/xfrm-state.c, functions xfrm_replay_check() and 
> xfrm_replay_advance().

Created attachment 11038 [details]
Validate replay window <= 32

We need to check that the replay_window value is not bigger than the
bitmap size.

Fixed in 2.6.21-rc6

The proposed patch, which consists in limiting the replay window size to 32, 
is not acceptable : RFC 2406 recommends a value of 64, and this value is used 
by many applications.
The bitmap management must be modified in order to cope with values up to 64 
at least (and preferably 128).

Unfortunately, Linux made a mistake in implementing this and the interface
is restricted to 32 bits.  See include/linux/xfrm.h: struct xfrm_replay_state,
the bitmap field was chosen as 32 bits. This is then used in the replay
netlink message to the application.

For binary compatibility, this has to remain the same.