patchlwIP - A Lightweight TCP/IP stack - Patches: patch #10270, Idle-scan vulnerability fix

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10270: Idle-scan vulnerability fix

Submitter:  Samuel Martin <smartin>
Submitted:  Wed 03 Aug 2022 01:13:40 PM UTC
   
 
Category:  TCP Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None

Wed 03 Aug 2022 01:13:40 PM UTC, original submission:  

Overview


This series aims at making impossible to leverage devices running LwIP network stack as a zombie machine in idle-scan attack.

The implemented solution consists in forcing the IP ID field to 0 for small TCP packets, instead of using the automatically incremented value.

Tests


IP ID field set to 0 on TCP handshake messages


10.153.24.244 is the device running a LwIP stack

Without this fix



z$ sudo hping3 -S 10.153.24.244 -p 5001 -c 10
HPING 10.153.24.244 (wlp2s0 10.153.24.244): S set, 40 headers + 0 data bytes
len=44 ip=10.153.24.244 ttl=255 id=82 sport=5001 flags=SA seq=0 win=3000 rtt=111.9 ms
len=44 ip=10.153.24.244 ttl=255 id=83 sport=5001 flags=SA seq=1 win=3000 rtt=71.8 ms
len=44 ip=10.153.24.244 ttl=255 id=84 sport=5001 flags=SA seq=2 win=3000 rtt=55.8 ms
len=44 ip=10.153.24.244 ttl=255 id=85 sport=5001 flags=SA seq=3 win=3000 rtt=111.7 ms
len=44 ip=10.153.24.244 ttl=255 id=86 sport=5001 flags=SA seq=4 win=3000 rtt=71.3 ms
len=44 ip=10.153.24.244 ttl=255 id=88 sport=5001 flags=SA seq=5 win=3000 rtt=47.3 ms
len=44 ip=10.153.24.244 ttl=255 id=90 sport=5001 flags=SA seq=6 win=3000 rtt=79.1 ms
len=44 ip=10.153.24.244 ttl=255 id=91 sport=5001 flags=SA seq=7 win=3000 rtt=62.8 ms
len=44 ip=10.153.24.244 ttl=255 id=92 sport=5001 flags=SA seq=8 win=3000 rtt=110.6 ms
len=44 ip=10.153.24.244 ttl=255 id=95 sport=5001 flags=SA seq=9 win=3000 rtt=54.5 ms

--- 10.153.24.244 hping statistic ---
10 packets transmitted, 10 packets received, 0% packet loss
round-trip min/avg/max = 47.3/77.7/111.9 ms

z$ sudo hping3 -SA 10.153.24.244 -p 5001 -c 3
HPING 10.153.24.244 (wlp2s0 10.153.24.244): SA set, 40 headers + 0 data bytes
len=40 ip=10.153.24.244 ttl=255 id=101 sport=5001 flags=RA seq=0 win=47115 rtt=108.1 ms
len=40 ip=10.153.24.244 ttl=255 id=102 sport=5001 flags=RA seq=1 win=47115 rtt=51.9 ms
len=40 ip=10.153.24.244 ttl=255 id=105 sport=5001 flags=RA seq=2 win=47115 rtt=99.8 ms

--- 10.153.24.244 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 51.9/86.6/108.1 ms


With this fix



z$ sudo hping3 -S 10.153.24.244 -p 5001 -c 10
HPING 10.153.24.244 (wlp2s0 10.153.24.244): S set, 40 headers + 0 data bytes
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=0 win=3000 rtt=108.0 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=1 win=3000 rtt=51.9 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=2 win=3000 rtt=111.8 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=3 win=3000 rtt=55.7 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=4 win=3000 rtt=59.6 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=5 win=3000 rtt=47.5 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=6 win=3000 rtt=63.5 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=7 win=3000 rtt=103.5 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=8 win=3000 rtt=67.3 ms
len=44 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=SA seq=9 win=3000 rtt=43.1 ms

--- 10.153.24.244 hping statistic ---
10 packets transmitted, 10 packets received, 0% packet loss
round-trip min/avg/max = 43.1/71.2/111.8 ms

z$ sudo hping3 -SA 10.153.24.244 -p 5001 -c 3
HPING 10.153.24.244 (wlp2s0 10.153.24.244): SA set, 40 headers + 0 data bytes
len=40 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=RA seq=0 win=47115 rtt=100.1 ms
len=40 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=RA seq=1 win=47115 rtt=47.9 ms
len=40 ip=10.153.24.244 ttl=255 id=0 sport=5001 flags=RA seq=2 win=47115 rtt=51.9 ms

--- 10.153.24.244 hping statistic ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max = 47.9/66.6/100.1 ms


nmap idle-scan test


The test setup is:

  • 10.153.25.204: attacker (device on which nmap commands are run)
  • 10.153.24.42: target (device having a http server running and listening on port 8080)
  • 10.153.24.162: zombie (device running the LwIP stack)



The nmap idle-scan test is run on the following port on the target:

  • 22: closed
  • 80: closed
  • 5001: closed
  • 8080: open (http server)



z$ nmap -A -T4 10.153.24.42
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-02 14:14 CEST
Nmap scan report for 10.153.24.42
Host is up (0.060s latency).
Not shown: 996 closed ports
PORT     STATE SERVICE     VERSION
[...]
8080/tcp open  http        SimpleHTTPServer 0.6 (Python 3.6.8)
[...]
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.59 seconds


Without this fix



z$ sudo nmap -Pn -sI 10.153.24.162:5001 -p 22,80,5001,8080 10.153.24.42
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-02 14:22 CEST
Idle scan using zombie 10.153.24.162 (10.153.24.162:5001); Class: Incremental
Nmap scan report for 10.153.24.42
Host is up (0.17s latency).

PORT     STATE           SERVICE
22/tcp   closed|filtered ssh
80/tcp   closed|filtered http
5001/tcp closed|filtered commplex-link
8080/tcp open            http-proxy
MAC Address: AC:2B:6E:F1:5C:6B (Intel Corporate)

Nmap done: 1 IP address (1 host up) scanned in 5.01 seconds


With this fix



z$ sudo nmap -Pn -sI 10.153.24.162:5001 -p 22,80,5001,8080 10.153.24.42
Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-02 14:26 CEST
Idle scan zombie 10.153.24.162 (10.153.24.162) port 5001 cannot be used because it has not returned any of our probes --
perhaps it is down or firewalled.
QUITTING!


Samuel Martin <smartin>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by smartin (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-08-03 smartin Attached File- Added 0001-ip4-Add-IP_MIN_FRAG_LENGTH-definition.patch, #53499
        Attached File- Added 0002-ip4-Add-IP4_MIN_MTU_LENGTH-definition.patch, #53500
        Attached File- Added 0003-ip4-tcp-send-zero-IP_ID-for-small-packets.patch, #53501

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code