tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Yizhou Zhao reported that simply having one RAW socket on protocol
IPPROTO_RAW (255) was dangerous.

socket(AF_INET, SOCK_RAW, 255);

A malicious incoming ICMP packet can set the protocol field to 255
and match this socket, leading to FNHE cache changes.

inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST")
pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner

"man 7 raw" states:

A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able
to send any IP protocol that is specified in the passed header.
Receiving of all IP protocols via IPPROTO_RAW is not possible
using raw sockets.

Make sure we drop these malicious packets.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/netdev/20251109134600.292125-1-zhaoyz24@mails.tsinghua.edu.cn/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260203192509.682208-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Eric Dumazet and committed by
Jakub Kicinski c89477ad 6a65c0cb

+16 -4
+10 -4
net/ipv4/icmp.c
··· 1031 1031 /* Checkin full IP header plus 8 bytes of protocol to 1032 1032 * avoid additional coding at protocol handlers. 1033 1033 */ 1034 - if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) { 1035 - __ICMP_INC_STATS(dev_net_rcu(skb->dev), ICMP_MIB_INERRORS); 1036 - return; 1037 - } 1034 + if (!pskb_may_pull(skb, iph->ihl * 4 + 8)) 1035 + goto out; 1036 + 1037 + /* IPPROTO_RAW sockets are not supposed to receive anything. */ 1038 + if (protocol == IPPROTO_RAW) 1039 + goto out; 1038 1040 1039 1041 raw_icmp_error(skb, protocol, info); 1040 1042 1041 1043 ipprot = rcu_dereference(inet_protos[protocol]); 1042 1044 if (ipprot && ipprot->err_handler) 1043 1045 ipprot->err_handler(skb, info); 1046 + return; 1047 + 1048 + out: 1049 + __ICMP_INC_STATS(dev_net_rcu(skb->dev), ICMP_MIB_INERRORS); 1044 1050 } 1045 1051 1046 1052 static bool icmp_tag_validation(int proto)
+6
net/ipv6/icmp.c
··· 1066 1066 if (reason != SKB_NOT_DROPPED_YET) 1067 1067 goto out; 1068 1068 1069 + if (nexthdr == IPPROTO_RAW) { 1070 + /* Add a more specific reason later ? */ 1071 + reason = SKB_DROP_REASON_NOT_SPECIFIED; 1072 + goto out; 1073 + } 1074 + 1069 1075 /* BUGGG_FUTURE: we should try to parse exthdrs in this packet. 1070 1076 Without this we will not able f.e. to make source routed 1071 1077 pmtu discovery.