CVE-2021-43267

Отчет

This issue affects Red Hat Enterprise Linux 8 starting with the kernel that shipped with Red Hat Enterprise Linux 8.4 GA (kernel-4.18.0-305.el8). Previous Red Hat Enterprise Linux 8 kernel versions were not affected as they did not include the vulnerable functionality. Red Hat recommends to use transport level to separate and/or secure (by both encrypting and authenticating via eg. IPSec/MACSec) the communication between nodes. This limits the exposure of this issue to semi-trusted nodes.

Меры по смягчению последствий

The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module. Loading the module can be prevented with the following instructions:

echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf

The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use. If the system requires this module to work correctly, this mitigation may not be suitable. If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services. To mitigate the issue on systems that do need to use TIPC and do not deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec):

• BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION -

1. On the host, save the following in a file with the ".stp" extension: %{ #include <linux/skbuff.h> #define MSG_CRYPTO 14 #define SOCK_WAKEUP 14 /* pseudo user / #define TOP_SRV 15 / pseudo user */ struct tipc_msg { __be32 hdr[15]; }; static inline struct tipc_msg *buf_msg(struct sk_buff *skb) { return (struct tipc_msg *)skb->data; } static inline u32 msg_word(struct tipc_msg *m, u32 pos) { return ntohl(m->hdr[pos]); } static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val) { m->hdr[w] = htonl(val); } static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask) { return (msg_word(m, w) >> pos) & mask; } static inline void msg_set_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask, u32 val) { val = (val & mask) << pos; mask = mask << pos; m->hdr[w] &= ~htonl(mask); m->hdr[w] |= htonl(val); } static inline u32 msg_user(struct tipc_msg *m) { return msg_bits(m, 0, 25, 0xf); } static inline void msg_set_user(struct tipc_msg *m, u32 n) { msg_set_bits(m, 0, 25, 0xf, n); } %} function sanitize:long (skb:long) %{ struct sk_buff *skb; struct tipc_msg *hdr; #if STAP_COMPAT_VERSION >= STAP_VERSION(1,8) skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb; #else skb = (struct sk_buff *) (unsigned long) THIS->skb; #endif hdr = buf_msg(skb); if(msg_user(hdr) == MSG_CRYPTO) { msg_set_user(hdr, TOP_SRV); // set to invalid in this context } %} probe module("tipc").function("tipc_data_input").call { sanitize($skb); }
2. Install the "systemtap" package and any required dependencies (such as kernel-devel and kernel-debuginfo packages).
3. Run the "stap -g [filename-from-step-1].stp" command as root. If the host is rebooted, the changes will be lost and the script must be run again. Alternatively, build the systemtap script on a development system with "stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel module to all affected systems, and run "staprun -L " on those. When using this approach only systemtap-runtime package is required on the affected systems. Please notice that the kernel version must be the same across all systems.