CVE-2019-10639
Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to have a dependency on an address associated with a network namespace.
El kernel de Linux versión 4.x (a partir de versión 4.1) y versión 5.x anterior a 5.0.8, permite la Exposición de Información (divulgación parcial de la dirección del kernel), lo que conlleva a una omisión de la funcionalidad KASLR. Específicamente, es posible extraer el desplazamiento de la imagen del kernel KASLR utilizando los valores ID de IP que el kernel produce para los protocolos sin conexión (por ejemplo, UDP e ICMP). Cuando dicho tráfico se envía a múltiples direcciones IP de destino, es posible obtener colisiones de hash (de índices en la matriz counter) y, por lo tanto, obtener la clave de hashing (mediante enumeración). Esta clave contiene suficientes bits de una dirección de kernel (de una variable estática) de manera que cuando se extrae la clave (por medio de la enumeración), queda expuesto el desplazamiento de la imagen del kernel. Este ataque se puede llevar a cabo remotamente, ya que el atacante forza al dispositivo de destino a enviar tráfico UDP o ICMP (o algunos otros) hacia direcciones IP controladas por el atacante. Forzar a un servidor a enviar tráfico UDP es trivial si el servidor es un servidor DNS. El tráfico de ICMP es trivial si el servidor responde a las peticiones de Eco de ICMP (ping). Para los objetivos cliente, si el objetivo visita la página web del atacante, entonces puede ser usado WebRTC o gQUIC para forzar el tráfico UDP hacia las direcciones IP controladas por el atacante. NOTA: este ataque contra KASLR se volvió viable en versión 4.1 porque la generación de ID de IP fue cambiada para tener una dependencia en una dirección asociada con un espacio de nombre de red.
A flaw was found in the way the Linux kernel derived the IP ID field from a partial kernel space address returned by a net_hash_mix() function. A remote user could observe this IP ID field to extract the kernel address bits used to derive its value, which may result in leaking the hash key and potentially defeating KASLR.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-03-29 CVE Reserved
- 2019-07-05 CVE Published
- 2024-08-04 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-326: Inadequate Encryption Strength
CAPEC
References (18)
| URL | Tag | Source |
|---|---|---|
| https://arxiv.org/pdf/1906.10478.pdf | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2019/07/msg00022.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html | Mailing List |
|
| https://seclists.org/bugtraq/2019/Aug/18 | Mailing List |
|
| https://security.netapp.com/advisory/ntap-20190806-0001 | X_refsource_confirm |
|
| https://support.f5.com/csp/article/K32804955 | X_refsource_confirm | |
| https://support.f5.com/csp/article/K32804955?utm_source=f5support&%3Butm_medium=RSS | X_refsource_confirm | |
| https://www.oracle.com/security-alerts/cpuApr2021.html | X_refsource_misc |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html | 2023-11-07 | |
| http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html | 2023-11-07 | |
| https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8 | 2023-11-07 | |
| https://usn.ubuntu.com/4115-1 | 2023-11-07 | |
| https://usn.ubuntu.com/4118-1 | 2023-11-07 | |
| https://www.debian.org/security/2019/dsa-4497 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2019-10639 | 2020-06-11 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1729933 | 2020-06-11 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.1 <= 4.20.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.1 <= 4.20.9" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.0 < 5.0.8 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.0 < 5.0.8" | - |
Affected
| ||||||