Към съдържанието
Търсене

CVE-2026-99077: Linux

7.4

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, при специфични условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the FNHE cache in order to discover the ephemeral port used by a connected UDP socket. Commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()") and commit 67d6d681e15b ("ipv4: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the FNHE cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating a FNHE, even before trying to find a matching socket. Do that by calling ipv4_update_pmtu() and ipv4_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in a FNHE being created or updated in the cache that the attacker can observe. Pass an oif of 0, in a similar fashion to icmp_err(). This is also the oif used by the socket path for sockets that are not bound to a device. Note that this does not allow attackers to create FNHEs that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMP error that quotes an ICMP Echo Reply or one that quotes a UDP source port that matches a wildcard socket. Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ipv4_sk_update_pmtu() / ipv4_sk_redirect(). When the

    Засегнати продукти

    • Linux Linux: 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди e8f211a37396f1684af9ac81b3fc53538eb9c2f7; 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди 9f97b01ee799bdf57d9183623f3987c8bbfd4f6f; 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди e0cd4942831d4ef8f6d4b90b0d3510460fdfbceb; 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди 0cf0ff2f728f2a1434c56c0bcf267fe230abf124; 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди 3b92e4349c6b0dd1e05d5f0483e71ef37691b1c3; 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди ecd7ead4bf05e221e90f18a29aec570a50fd1592; 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди be4fd05398f2b5e42029be70ee875fc749b8ce3a; 4895c771c7f006b4b90f9d6b1d2210939ba57b38 преди 4c3499f79f8c7e8561266bcc220a18538cec0458
    • Linux Linux: 3.6; преди 3.6; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.161 до 6.6.*; 6.12.115 до 6.12.*; 6.18.59 до 6.18.*; 7.2.11 до 7.2.*; от 7.3 нататък

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-99077: Linux | freedomonline.bg