A critical vulnerability has been identified in the Linux kernel implementation of the network protocol TIPC (Transparent Inter-process Communication) (CVE-2021-43267), allowing an attacker to execute their code with kernel privileges remotely by sending a specially crafted network packet. The danger of this issue is mitigated by the fact that explicit support for TIPC must be enabled on the system (loading and configuring the kernel module tipc.ko), which is not enabled by default in generic Linux distributions.
The TIPC protocol has been supported since Linux kernel 3.19, but the code leading to the vulnerability was included in kernel 5.10. The vulnerability has been fixed in kernels 5.15.0, 5.10.77, and 5.14.16. The issue is still present and has not been resolved in Debian 11, Ubuntu 21.04/21.10, SUSE (in the yet-to-be-released branch SLE15-SP4), RHEL (it is not yet detailed whether the vulnerable fix was backported), and Fedora. A kernel update has already been released for Arch Linux. Distributions with kernels older than 5.10, such as Debian 10 and Ubuntu 20.04, are not affected by the issue.
The TIPC protocol was originally developed by Ericsson and is intended for inter-process communication within a cluster, mainly activated on cluster nodes. TIPC can operate over both Ethernet and UDP (network port 6118). When working over Ethernet, an attack can be conducted from the local network, while using UDP allows for attacks from the global network if the port is not protected by a firewall. An attack may also be performed by an unprivileged local user on the host. To activate TIPC, the tipc.ko kernel module must be loaded, and it should be bound to the network interface using netlink or the tipc utility.
The vulnerability manifests in the function tipc_crypto_key_rc and is caused by a lack of proper validation of the declared and actual size of data when parsing packets of type MSG_CRYPTO, which are used to obtain encryption keys from other nodes in the cluster for subsequent decryption of messages sent from those nodes. The size of the data copied to memory is calculated as the difference between the message size and the header size fields, but without taking into account the actual size of the encryption algorithm name and key content transmitted in the message. It is implied that the size of the algorithm name is fixed, and for the key, a separate attribute with the size is additionally transmitted, allowing the attacker to specify a value in this attribute that differs from the actual size, leading to writing the message tail outside the allocated buffer. struct tipc_aead_key { char alg_name[TIPC_AEAD_ALG_NAME]; unsigned int keylen; /* in bytes */ char key[]; };
Source: opennet.ru
