Linux 2.2 DoS Attack 270
A small bug in the Linux networking code has been found, and just as quickly patched. The
bug affects all Linux 2.2 kernels, and can be fixed by removing "kfree_skb(skb);" from around line 455 of
linux/net/ipv4/ip_options.c. Big thanks to Alan Cox on this one.
Not a bad responce time! (Score:1)
Kudos to Alan and the rest of the Linux community.. Lets see a close source vendor come back with a 5hour turn around on a obscure one line logic boob bug.
Re:From Alen Cox mouth (Score:1)
Software always insecure because it's never done. (Score:1)
Re:Any reasons for using Linux 2.2 instead of 2.0. (Score:1)
im sure theres a lot more
Re:Software always insecure because it's never don (Score:1)
I would rather have a computer on my desk that crashes occasionally, than core memory.
Panic (Score:1)
Non-Ipv4 kernels affected? (Score:1)
only Intel? (Score:1)
(all boxes are running 2.2.9)
Exploiter is a PII 233
exploited 1 is a dual pentium 133Mhz and crashed after 74 and 138 "b00m"s.
exploited 2 is a single 21164 600Mhz (DEC Alpha) and caused the "b00m" program to die after 367 packets with the following line "Unable to get host name: Connection refused".
will continue playing and see how many will be needed to bring down the PII, but I wanna know if anyone else has noticed similar "oddities" in this exploit (ie., has anyone crashed a non-x86)?
Re:Moderators.. (Score:1)
This criteria makes no sense. The post *is* a good post. What it is repetitive aka needless in your words.
We all know that he was trying to be helpful, and had he gotten here about 2 minutes earlier, he probably would have gained points instead of getting a -1.
Ridiculous. He's penalized for the time it takes a slashdot page to update with the other person's post? or the time it took him to (after checking for like postings) cut, paste, and preview?
Mind you, I agree that repetitive posts need to be cut down on. I do not see it fair, however, to negatively moderate. Don't cast it off as solely an aspect of "moderation." In most cases of moderation, there is not a peer review system. In most cases, a repetitive post would never make it through, but would also not be held against someone.
You could simply fix the problem by adding a criteria of "useful but repetitive" such that it acts as a -1 or -2 when comments are viewed, but does not contribute to the person's "average."
Re:OPENBSD (Score:1)
Why you should run 2.2.x, in very small words... (Score:1)
If all you're worried about is what Linux can do for you, it would seem you don't totally GET what Open Source is about. We all participate. If you can't code, document or test or something.
But don't just sit back and say "2.0 works for me," because then you're just taking other peoples' work without giving anything back, and that's no way to run a community.
If you have a machine that's not 100% mission-critical, run 2.2.x on it. And in a few months, when 2.2 settles down, run it on your mission-critical machines.
And when 2.3.x gets past the point of exploding, start running it, and find bugs and report them and help make Linux better.
Contribute, people, don't just take.
disagree (Score:1)
That's too negative. If a particular version of open source software meets somebody's needs, who are you to say they are not benefitting the open source community unless they try a newer version and send back code and/or bug reports? One type of contribution you are completely ignoring is the satisfied user who becomes an open source advocate to potential new users.
External Zip Drives among other things (Score:1)
rather reboot into Windows just to copy files from my Zip disk. Now, the access rates are about the same as in Windows if not better.
The frame buffer devices are also _very_ nice. Not to mention better management for modules and such.
Really though, the clincher was the vastly improved parallel port driver. Oh, and you can print and access the Zip drive at the same time too. Very nice.
It's a DOS *NOT* a root exploit. (Score:2)
From Alen Cox mouth (Score:4)
Can someone tell me what that output means?
--------------cut here---------------------
Ok problem confirmed. Its not icmp however - in fact the program given
has some bugs that cause it. If it had been a correctly written icmp tester
it wouldnt have worked. A blessing in disguise.
Anyway the fix seems to be this. Sorry it took so long to sort out.
---
+++ net/ipv4/ip_options.c Tue Jun 1 22:11:46 1999
@@ -452,7 +452,6 @@
error:
if (skb) {
icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((pp_ptr-iph)- kfree_skb(skb);
}
return -EINVAL;
}
Alan
It's not a remote exploit! (Score:5)
PLEASE update the post to indicate that this is a crash and not a root explot.. PLEASE!
Re:Some people.... (Score:1)
Moderators.. (Score:1)
Re:Firewalling ICMP takes care of this, folks. (Score:1)
Period.
So, my grandmother.. On a dialup account on a win95 box.. In a support for disability channel on IRC.. deserves to be teardroped?
Re:BUGTRAQ (Score:1)
Re:Ho HUmmmm (Score:3)
--
David Coulson (TechNoir)
themes.org Senior Developer
LinuxHQ (Score:2)
Re:Cool, yet another thing for scr|pt kiddies to d (Score:2)
probably not a linux problem... (Score:1)
I had similar problems with 2 IOMEGA Jaz Drives. The fact is that a good number of IOMEGA Jaz/Zip drives are defective. One of the better known problems is discussed at this page [grc.com].
IOMEGA makes garbage hardware. It's a cryin' shame that they have established such a monopoly in the removable media industry.
----------------- ------------ ---- --- - - - -
I wish linux had service packs. (Score:2)
- A.P.
--
"One World, One Web, One Program" - Microsoft Promotional Ad
Re:I wonder ... (Score:2)
A classic newbie prank is to pipe the output of banner to write to disply obnoxious stuff on someone else's screen. (It's almost as classic as using xloadimage to change someone's root window to a hardcore porn pic). This guy obviously hasn't gotten over it, though honestly I laughed my ass off when I saw it.
2.3 as well? (Score:2)
Re:LinuxHQ (Score:2)
2.2.10pre2 (Score:2)
Re:2.3 as well? (Score:3)
And who are you to be saying who "needs" to be running 2.3? I probably don't _need_ to be running it - I'm not working on USB or any of the other stuff that's new in 2.3 - but I am anyway. I figure that if it nukes my box, no problem... I'm not doing it on a main server for exactly that reason. And I might run across a problem with it that others wouldn't because of my particular hardware setup... I doubt there are many people doing kernel dev on a 386. And then I can either track down the problem myself (though I can seldom do it fast enough to keep up with the fixes that everyone else is sending in) or submit a bug report to linux-kernel so someone else can track it down. That's how free source works.
Re:Why use Linux 2.2 -- 2.0.36 is the best Linux y (Score:1)
Pretty strong language... (Score:1)
...from someone who doesn't know how to use a dictionary.
"censorship - the prevention of publication, transmission, or exhibition of material considered undesirable for the general public to possess or be exposed to."
--
"Please remember that how you say something is often more important than what you say." - Rob Malda
Now I get it! (Score:1)
So, when it says 'to comment', means that section of the code is 'not to be executed'!
All the time I thought that the author is requesting critiques or comments on the quality of his code.
Re:Linux won't get anywhere like that. (Score:1)
There's more 'casual users' here at
Mind you, I have no intention of remaining a 'casual user' forever, I just don't have the experience with the OS yet to be comfortable enough with it to be of any real help on any of the projects I'm potentially interested in.
Re:Use Linux 2.0.36 and never upgrade if you like! (Score:1)
1. Find and fix these innumerable horrible bugs [that nobody else seems to know anything about], or
2. Fork the codebase; start with 2.0.36 (since it's obviously the best version ever [except that it sucks]) and make your own 2.2.
Memory leak? (Score:2)
If I ever fix a bug in my code by removing a call to free() I tend to get very suspicious
Re:Cool, yet another thing for scr|pt kiddies to d (Score:1)
Why not? (Score:1)
Re:It's a DOS *NOT* a root exploit. (Score:2)
>nicely and sync up but it well, never works right
But of course. If it was in a condition to do it right, it probably wouldn't have to panic
Re:Isn't this a HUGE deal? Yes, and your point is? (Score:1)
I was amazed when I discovered how long a 2.2 was out before the first 2.3 became public. Shouldn't there be roughly 2-2 2.3 releases for each 2.2 release? Shouldn't there have been at least several 2.3 releases out before 2.2.0 went out?
Nope, the 2.1 series led up to 2.2, while 2.3 leads to 2.4. There were "at least several" (ahem!) releases in the 2.1 series.
dylan_-
--
Re:BUGTRAQ (Score:1)
Re:Why use Linux 2.2 -- 2.0.36 is the best Linux y (Score:1)
Re:Ho HUmmmm (Score:1)
Re:It's not a remote exploit! (Score:1)
Re:Software always insecure because it's never don (Score:1)
Maybe, but you don't fly your desk. I think.
Re:2.3 as well? (Score:1)
[offtopic] SIGFAULT? :) (Score:1)
Re:Pretty strong opinions... (Score:1)
"sarcasm - a mode of satirical wit depending for its effect on bitter, caustic, and often ironic language that is usually directed against an individual"
Re:[offtopic] SIGFAULT? :) (Score:1)
He means in C, and it actually does work (usually) (Score:1)
On the other hand, if it takes you more than 3 minutes to write and compile a C filter program to remove C++ comments from a file, you're not a Real Programmer(TM). But seriously, it's a trivial task -- so trivial that I don't see this as a good reason for not using C++ style comments these days in straight C code...
--
Re:Isn't this a HUGE deal? Yes, and your point is? (Score:1)
Or you can keep the problem private, meaning the cracker will almost certainly hear about it before the sysadmin, assuming he's out looking for vulnerabilities while the sysadmin is busy doing his job, which unfortunately encompasses much more than spending 24/7 looking for vulnerabilities no one will tell him about.
The suits may think twice, but what are they going to do, stop using computers? That's the only way to prevent this sort of thing.
Since you say "that isn't good enough", what should be done instead? What would be "good enough"? For software to never have bugs in the first place? That would be great! Oh, and have I have a little of what you're smoking? It sounds positively blissful...
Stick our heads in the sand and ignore the problem? That doesn't strike me as useful.
Switch to an OS where solutions don't appear within hours? That doesn't sound very smart.
Please, pray tell, since the situation here isn't "good enough", what is?
--
Re:There's a little more info in the Bugtraq post. (Score:1)
Re:Sheesh - Nice OS (Score:1)
I had to patch the
some exploit too.
2.2.x bugs (Score:1)
Good thing with a full packet log though, running on a box with a non-affected kernel
Isn't this the first serious remote crash bug in the 2.2.x series ? There have been other bugs allright, and there still is, but I believe this is the first remote one.
That is not bad, if one thinks about the _huge_ changes that went into the 2.2 series from the 2.0 series. I'm pretty amazed we haven't seen a few more of these already... They may be coming though.
I would have expected a bug like this to appear sooner. And I would have expected more of these bugs. Well, either the developers are blessed with luck, or they are really skilled. We'll see which, in the next few months I guess. Luck don't last.
Good work guys ! Also on the fix btw.
Re:Any reasons for using Linux 2.2 instead of 2.0. (Score:1)
I wonder ... (Score:1)
/dev
Four letters for ya ... (Score:1)
Speed!!!
2.2 also kicks ass on multiproc machines. but you
already knew that
traffic shaping too...
/dev
I never knew anyone that creative ... (Score:1)
or your whole term session anyway
/dev
Re:Four letters for ya ... (Score:1)
No I didn't. Cool.
As far as knfsd goes, yes I did measure it. It was between 20 and 30 percent faster for my app. it was a custom application that abused nfs for commo. (yes i do know how to use sockets! ugly app. don't ask :-) YMMV. I had been using BSD only because I found the Linux user space nfs to be to damn slow. knfs made a huge difference for me. Your right about the ext2fs stuff, it has been a pain for me too ... Unfort i'm not a filesystem guru.
Regarding SMP, most PCs are not SMP, and, I guess, most Linux users' PCs are not SMP.
I think you would be suprised. I'm finding more and more people I talk to run SMP boxes. But then most of them are eengineering/scientific types so I may have a tainted sample base. or something.
/dev
Both right and wrong ... (Score:3)
It would be damn near impossible to run a full qual. test on a modern OS. The complexity level is just to high and there are really no requirements to test anyway. The government will not (I hope) step in here. There is no reason for them to do so.
Think of it this way: it takes WEEKS of 24 hour computing to run a FQT on an aircraft digital flight control system. WEEKS. and this is a system with super super rigid, well defined, realtime requirements. There is no code in the system that is not used.
Now consider the Linux kernel. How many system calls are in there that joe average user never touches? How many combinations of things could be going on at one time? For all intents and purposes we are dealing with an infinite combination regression test situation here. or something.
With the complexity in modern realtime and avionics systems, we are pushing the limits of software test. Formal qual testing of general purpose software is a lost cause.
i'll stop rambling on now
/dev
There's a little more info in the Bugtraq post. (Score:5)
Linux kernel 2.2.x vulnerability/exploit
Piotr Wilkin (pwl@WOTAN.2SLO.WAW.PL)
Tue, 1 Jun 1999 17:43:17 +0200
Messages sorted by: [ date ][ thread ][ subject ][ author ]
Next message: Salvatore Sanfilippo -antirez-: "whois_raw.cgi problem"
Previous message: aleph1@UNDERGROUND.ORG: "New Allaire Security Bulletin (ASB99-09)"
I'm sorry if this has been noticed before, but since I did't find anything
in the archives, I post it here.
There seems to be a bug in kernels 2.2.x (tested on 2.2.7 and 2.2.9), that
causes them to panic when they are sent a large number of specific ICMP
packages. I think the problem comes from the combination of the mangled
header length (shorter or longer ihl's don't cause hangup) and the random
ICMP packets (random type/subtype and source address) this program sends.
Windows 9x and FreeBSD 3.0 seem to be unaffected.
I think the most interesting thing is the date, though... I'm sure I'm making a timezone mistake here, but isn't that 8 hours ago? Is that faster or slower than the Linux teardrop fix?
It's annoying to find out about a new DOS attack, but the resolution is all that you could hope for.
It's a little less annoying that there don't seem to be any outstanding instant-crash attacks against Win98 to laugh about - they finally fixed the series of attacks that crashed 95 for 8 months straight, and I haven't seen anything since. Did Microsoft finally get their IP stack right?
Re:He means in C, and it actually does work (usual (Score:1)
sed 's#//\(.*\)$#/*\1 */#'
Yes! Install Win2K IMMEDIATELY!! (Score:1)
Re:Why use Linux 2.2 -- 2.0.36 is the best Linux y (Score:1)
Re:Four letters for ya ... (Score:1)
Re:Cool, yet another thing for scr|pt kiddies to d (Score:1)
I'll go with the College kids. Hell, I'll go with the drunk college kids!
Re:It's not a remote exploit! (Score:1)
Re:Panic (Score:1)
Obviously there's no way to protect the machine against someone with superuser privileges from panicing it. But it is important to prevent unauthorized people from getting superuser privileges.
Re:[offtopic] SIGFAULT? :) (Score:1)
A panic occurs when the kernel detects a condition that should never happen, and from which no good recovery is possible. It should not be possible to cause a panic from user-space code (except perhaps by root processes doing naughty things like scribbling on /dev/kmem).
Patching running kernels (Score:1)
With Linux, just figure out where the offending instructions are by groveling through the compiler and linker output, and write to the relevant locations in /dev/kmem. For this particular bug, you probably only have to NOP out a few instructions.
Personally, I'm just as happy to reboot. It's not like it takes very long, and it's easier and safer. But if I were running a mission-critical 24x7 system, perhaps I'd think about it some more.
Re:Longer uptimes with 2.0.36 than 2.2 (Score:1)
What you propose won't work for several reasons:
Can you cite a single example of a software project of comparable complexity to the Linux 2.2 kernel which had fewer bugs at initial release? I didn't think so.
Re:Moderators.. (Score:1)
Also, having a single post at -1 won't throw off his alignment a great deal as long as he consistently gets his other posts bumped up a notch or two. Don't forget, too, that there are a few other items to be considered as to whether he gets access or not.
-mike kania
Re:I wish linux had service packs. (Score:1)
Such irony!
Jason.
Re:Memory leak? (Score:1)
Re:Non-Ipv4 kernels affected? (Score:1)
Firewalling ICMP takes care of this, folks. (Score:1)
Rather than let this dipshit have the last word, thought I'd mention that my box running 2.2.8 with ipchains firewalling and a rule banning incoming ICMP is NOT, i repeat ***NOT*** vulnerable to this exploit... just FYI. oh, and if you're not behind at LEAST one firewall and you're connected to the Internet, you deserve anything you get hit with-- regardless of OS.
Period.
buggy software (Score:1)
Sorry, just had a moment of strangeness.
Re:2.3 as well? (Score:1)
--
Ian Peters
Re:Longer uptimes with 2.0.36 than 2.2 (Score:1)
It's more stable solely because it's older. Wait until 2.2 gets a bit more mature, and it'll be just as stable (if not moreso) than 2.0 is, and will beat it senseless in the performance department as well.
TOASTED PATCH! (Score:5)
Re:Win95 added crashability (a little off topic) (Score:1)
For a comparison: Linux counts hundredths of seconds (except on the Alpha, where it too is ms but 64-bit) and will therefore last ten times longer until wrap around. However, kernel code is expected to survive a wrap and debugging is done in this area (like setting the timer variable to a few minutes before wrap at boot time and see where problems arise - 2.2 should have eliminated most of them).
Re:Four letters for ya ... (Score:1)
I have to say that i do own a SMP system and using a 2.2.7 kernel was personnaly a real pain even though it took 2 weeks to discover it.
With the same configuration but with 2.0.36 (UP) kernel, the system was more responsive. I have now switched to the devel series (2.3) and it works quite nicely.
greetings, seb.
--
Re:Ummm... Isn't this a HUGE deal??? (Score:2)
http://www.ntsecurity.net/scripts/loader.asp?iD
In short, every version of NT has a security exploit that allows any user to get root access. That's a far greater security risk than this DoS attack, which can simply crash your system.
It has been known for over ten weeks. And AFAIK, Microsoft hasn't released a fix (at least I can't find one on microsoft.com). It is possible that NT 4.0 Service Pack 5, released six weeks after the hole was found, fixes it -- for NT 4.0 users and NT users willing to pay to upgrade to 4.0 only.
Now, which is a bigger deal -- a DoS attack fixed eight hours after publication, or a root exploit unfixed for at least six weeks after publication?
Re:Linux won't get anywhere like that. (Score:1)
One certainly hopes. It would be a good step in accord with linux becoming part of the business community.
"Do you think the casual user actually wants to be involved in tracking down and reporting bugs?"
No, I realize the casual user wants to be blissfully unaware of anything at all. This applies to lots more than computers. (Driving, for instancce -- I don't think the casual driver wants to be involved in avoiding traffic accidents except those involving him.)
"No average user is interested in 'running a community'."
Wait just a minute. The average Linux user is,
or ought to be. Or else somebody missed something fundamental about what linux is somewhere along the way.
"They don't want to contribute to making an operating system, and that's why they
continue to pay for software instead of going open-source."
What's wrong with that? Is this how you characterize the average *linux* user? You're using windows users to illustrate the beliefs and
behaviors of linux users. I have a real problem with that.
Why all the goto's? (Score:1)
broke things, and trying to figure out where
it was freed elsewhere.
Could the root of the problem really be the
program logic, which is implemented using a nonzero number of goto's?
I realize that goto is only being used for throwing exceptions, but still... if you're
using goto's in code with malloc's, you're asking for trouble.
But then, I'm no kernel hacker...
Re:Firewalling ICMP takes care of this, folks. (Score:2)
incoming ICMP"
has your box breaking MTU path discovery, making
you a bad netizen.
http://www.worldgate.com/~marcs/mtu/
Re:bleeding edge? (Score:1)
In fact, I consider them more stable than 2.0 systems in many way... better, more dependable memory management is just the first of these improvements.
Re:Memory leak? (Score:2)
Minor Correction (Score:2)
This is not quite accurate. The actual bug was in Windows 95 (still in 98? Don't know). They discovered that the uptime counter rolled over after approximately the number of days you mentioned, and crashed the box. This was discovered, if I remember correctly, earlier this year (it seems that in 3 and 1/2 years NO ONE had ever successfully kept a Win95 box up for that long!).
NT, however, does not suffer from this particular bug. I have a client who managed to keep his NT box up for at least 78 days -- mostly because the machine was so little used (he's an exec, not a geek). After 78 or so days, he had next to no free RAM left for anything. The leaks in the OS itself had plugged the system horribly. Nevertheless, this man did successfully run it for 78+ days.
If a bug like this were in Windows... (Score:2)
For Windows 98: "I sure hope that there aren't any more delays on that service release! It's been a year already! I hope this bug's covered in it or I'll have to wait another 6 to 8 months!"
For Windows NT: "Lessee, I can apply this 'unsupported' hotfix that Microsoft released...or I can wait for Service Pack 6 due in 3-6 months..."
Meanwhile, for Linux, it's this: "5 hours for a patch? What TOOK so long???"
Re:Firewalling ICMP takes care of this, folks. (Score:2)
Firewalls are not the answer to these problems either. These bugs need to be fixed, dumb protocols need to be fixed or discarded, in stead of patching things up with kludges and afterthoughts like IPSEC, firewalls and the like.
It would be nice if people would start designing protocols with security in mind, in stead of trying to add it on afterward.
Sorry about the rant.
Re:From Alen Cox mouth (Score:3)
The answer is, basically, that the output is patch-style diff output. It says that comparing ip_options.c in the linux.vanilla hierarchy to the ip_options.c in the current hierarchy, you can make vanilla like current by removing the line that says 'kfree_skb(skb);' ; in other words, that's the technical version of what was mentioned on the main article.
I have a memory like a sieve, so I won't attempt to tell you how, but you can take those lines and pipe them through diff and patch your kernel that way. I think it may be as simple as being root and doing 'patch filename', but if I were you I'd check the manpages (for diff, and patch) before trying anything. For a one-liner it's probably just as easy to cut it by hand.
Re:Moderators.. (Score:2)
Perhaps only some forms of comment-downgrading should count against one's user total? Like Flamebait or Troll, while Offtopic and Redundant will only affect the single comment and not your alignment?
Designing a proper comment rating system is hard work, to be sure. I wonder if Godel's theorem that no set of logical axioms can be both consistent and complete extends to ANY SYSTEM, be it a comment-rating system, or an OS? Heh...reminds me of the other comment here suggesting a formal proof of an OS...microkernel territory there...probably the extending of Godel to any system is one of those truisms that can't be proven...totally meta...
Felix
from bugtraq (Score:2)
From: Piotr Wilkin
Subject: Linux kernel 2.2.x vulnerability/exploit
I'm sorry if this has been noticed before, but since I did't find anything
in the archives, I post it here.
There seems to be a bug in kernels 2.2.x (tested on 2.2.7 and 2.2.9), that
causes them to panic when they are sent a large number of specific ICMP
packages. I think the problem comes from the combination of the mangled
header length (shorter or longer ihl's don't cause hangup) and the random
ICMP packets (random type/subtype and source address) this program sends.
Windows 9x and FreeBSD 3.0 seem to be unaffected.
[exploit code snipped, check www.geek-girl.com for it in the archive if you really need to know]
C comments (Score:2)
However, not all compilers have not caught up. I don't know of specific examples, but some Unix variants still do not understand it. Therefore you should not use it if you intend to make your source code widely available. And if you think your source code will never, ever be widely available or maintained by someone else, think again.
Incidentally, in C and C++ another way to comment out source code is like this:
main() {
char *s = "Hello world!";
#if 0
s = "World, hello!";
#endif
puts(s);
}
Since "0" is always false, s = "World, hello!" will not be compiled.
That way the commenting can be nested and you can be sure compilers will recognize it. A drawback is that colorized editors will not recognize it as a comment. Another drawback is that there is no equivalent in Java and you have to fall back to regular comments.
Re:It's a DOS *NOT* a root exploit. (Score:2)
Re:Da patch... (Score:5)
linux/ means the directory where the Linux kernel sources live. Typically, when one refers to linux/ one means /usr/src/linux/ although this isn't a given. net/ means the dibdirectory called net/ ; ipv4/ means the subdirectory of net/ called ipv4/ ; ip_options.c is the file you want to edit. You want to open this file with your favorite text editor, preferably one that displays line numbers somewhere. (You can toggle whether emacs displays your current line number with M-x line-number-mode.) To comment out C code, you can use /* ... */ . Comments like these can't be nested. It's pretty easy to comment out large sections of code like this. (You'll fairly often see people using // for comments in C code, but it's a bad idea, and you shouldn't do it. Don't Be That Guy (tm)!)
HTH
Re:Da patch... (Score:2)
Da patch... (Score:3)
And I JUST compiled 2.2.9 today!!! Arrgh!
"I have no respect for a man who can only spell a word one way." - Mark Twain
Re:Memory leak? (Score:2)