CVE-2021-20322: High severity Linux Linux kernel vulnerability
A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source port randomization are indirectly affected as well.
Other sources
A flaw in the processing of the received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. This flaw is similar to the previous CVE-2020-25705 (both DNS poisoning attack based on ICMP replies for open ports scanning, but other type of ICMP packets).
As result of research work, Keyu Man reported that the IP fragments (fragmented PING echo reply) could be used by attackers to get useful signal (that for example could be used for the DNS poisoning attack). After considering what could be improved in kernel to prevent this, there two suggested ways: I. The most direct way is to use the socket option IPPMTUDISCOMIT, which instructs the OS not to accept the ICMP frag needed messages and therefore eliminates the side channel related processing in the kernel; II. Randomize the caching structure: (1) the max length of the linked list used for solving hash collisions (currently 5), (2) the eviction policy (currently the oldest will always be evicted), (3) the secret of hash function, i.e., we can re-key periodically (every few seconds or tens of seconds).
Reference (for IPv6 and IPv4 patch respectively): git commit 4785305c05b25a242e5314cc821f54ade4c18810 (plus a00df2caffed3883c341d5685f830434312e4a43) and 6457378fe796815c973f631a1904e147d6ee33b1 (plus 67d6d681e15b578c1725bad8ad079e05d1c48a8e).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.rt7.166.el8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.9.1.el8 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.49.1.rt7.121.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.49.1.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
For the most direct mitigation, set the socket option IP_PMTUDISC_OMIT so the OS does not accept ICMP frag needed messages, eliminating the kernel side-channel processing tied to the ICMP fragment needed/ICMP redirect flaw.
Linux kernel (IP stack) IP_PMTUDISC_OMIT = enable (use socket option IP_PMTUDISC_OMIT) - Configuration
Apply the suggested kernel change to 'Randomize the caching structure' to address the ICMP error processing side channel (the material describes improving max linked-list length for hash collisions, eviction policy, and periodic re-keying via secret randomization).
Linux kernel (hash collision / caching structure used in processing) randomize caching structure parameters = randomize (referred as 'Randomize the caching structure') - Compensating control
Use network-level filtering to reduce exposure to off-path probing that leverages received ICMP errors for UDP port scanning (e.g., restrict/allow ICMP types needed for your environment and block the side-channel-related ICMP fragment-needed/ICMP redirect traffic at network controls).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-20322?
CVE-2021-20322 is classified as a high severity vulnerability due to its ability to enable remote users to bypass UDP source port randomization.
What systems are affected by CVE-2021-20322?
CVE-2021-20322 affects various versions of the Linux kernel, specifically kernel versions prior to 5.15 and specific Red Hat kernel packages.
How do I fix CVE-2021-20322?
To remediate CVE-2021-20322, update your kernel to a patched version such as 0:4.18.0-372.9.1.el8 or 5.15.
Can CVE-2021-20322 be exploited remotely?
Yes, CVE-2021-20322 can be exploited by off-path remote users to scan open UDP ports effectively.
What are the mitigations for CVE-2021-20322?
Mitigations for CVE-2021-20322 include applying the necessary kernel updates and following best practices for network security.