lwIP - A Lightweight TCP/IP stack - Patches: patch #10270, Idle-scan vulnerability fix
You are not allowed to post comments on this tracker with your current authentication level.
patch #10270: Idle-scan vulnerability fix
Submitter: | Samuel Martin <smartin> | ||
Submitted: | Wed 03 Aug 2022 01:13:40 PM UTC | ||
Category: | TCP | Priority: | 5 - Normal |
Status: | None | Privacy: | Public |
Assigned to: | None | Open/Closed: | Open |
Planned Release: | None |
Attached Files
file #53499: 0001-ip4-Add-IP_MIN_FRAG_LENGTH-definition.patch added by smartin (1KiB - text/x-patch)
file #53500: 0002-ip4-Add-IP4_MIN_MTU_LENGTH-definition.patch added by smartin (857B - text/x-patch)
file #53501: 0003-ip4-tcp-send-zero-IP_ID-for-small-packets.patch added by smartin (2KiB - text/x-patch)
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 3 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2022-08-03 | smartin | Attached File | - | Added 0001-ip4-Add-IP_MIN_FRAG_LENGTH-definition.patch, #53499 | |
Attached File | - | Added 0002-ip4-Add-IP4_MIN_MTU_LENGTH-definition.patch, #53500 | |||
Attached File | - | Added 0003-ip4-tcp-send-zero-IP_ID-for-small-packets.patch, #53501 |
Powered by Savane 3.13-f8d8.
Corresponding source code
Overview
This series aims at making impossible to leverage devices running LwIP network stack as a zombie machine in idle-scan attack.
The implemented solution consists in forcing the IP ID field to 0 for small TCP packets, instead of using the automatically incremented value.
Tests
IP ID field set to 0 on TCP handshake messages
10.153.24.244 is the device running a LwIP stack
Without this fix
With this fix
nmap idle-scan test
The test setup is:
The nmap idle-scan test is run on the following port on the target:
Without this fix
With this fix