In the Linux kernel, the following vulnerability has been resolved:
icmp: change the order of rate limits
ICMP messages are ratelimited :
After the blamed commits, the two rate limiters are applied in this order:
1) host wide ratelimit (icmpglobalallow())
2) Per destination ratelimit (inetpeer based)
In order to avoid side-channels attacks, we need to apply the per destination check first.
This patch makes the following change :
1) icmpglobalallow() checks if the host wide limit is reached. But credits are not yet consumed. This is deferred to 3)
2) The per destination limit is checked/updated. This might add a new node in inetpeer tree.
3) icmpglobalconsume() consumes tokens if prior operations succeeded.
This means that host wide ratelimit is still effective in keeping inetpeer tree small even under DDOS.
As a bonus, I removed icmp_global.lock as the fast path can use a lock-free operation.
{ "vanir_signatures": [ { "id": "CVE-2024-47678-36f38eeb", "signature_type": "Line", "target": { "file": "net/ipv6/icmp.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "91289001910167603209881474556047510214", "43604345262233481488365893161035522670", "191623554490438089051572192730373471672", "194539654146587661586150983770760097470", "127261948703496509685494445203220364071", "338260810542210976259907501182263023510", "30077527803713098293261738055554396278", "249973482290032730248919894254370764045", "101701359409798882129372676499844887751", "1060303226339384356912941767363463148", "101446597311668586980033306694916207301", "67795026953232399826496502989434842983", "90381654180237439634087930024852783303", "80650289431370108252637882426895847977", "96955886981929068098458569432792525875", "235227303343946055332160326071631402634", "263616400155007652289899586365285209798", "21592265157640723169388370404222986430", "245113637253098824716438214481601323451", "186353411879988212469412263916978478036", "139583817413745451752796837366183941534", "265329172698021184396587977109418547778", "71664794046839083546784688941960789286", "330642889012034253225053662030152743680", "234901233948231467323091556495107035105", "204720266493864144973279941690524799725", "272941920193792471341645536947861788276", "312574246816121541801935959910550024595", "59395773259214621105184333859427067804", "297948295420741314539879969407412432041", "251278741849392429965981245955749402785", "203091882942139292100267101314227039481", "161915303738510161701631189610098527576", "165883150596330895323640750293712777317", "19435313629652587904503531211546035069", "219686218353048183668934888305008167514", "295862042834303324903471112751868033795", "138833396233306478005359887248171281539", "260736583063016212896180591666943975415", "237986758334781159354204691123623105448", "308926888773904026352077563895728251282", "600033681825050615338758221467094821", "313853256423767869577290399130019506547", "120482624331934487721197881820146587425" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-6f6b8af9", "signature_type": "Function", "target": { "file": "net/ipv6/icmp.c", "function": "icmp6_send" }, "signature_version": "v1", "digest": { "length": 3671.0, "function_hash": "113797100165405442630183666105192081121" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-76aa67b3", "signature_type": "Function", "target": { "file": "net/ipv4/icmp.c", "function": "icmpv4_xrlim_allow" }, "signature_version": "v1", "digest": { "length": 591.0, "function_hash": "210535056199440052945744151499878942689" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-7e2cfbda", "signature_type": "Function", "target": { "file": "net/ipv4/icmp.c", "function": "__icmp_send" }, "signature_version": "v1", "digest": { "length": 2995.0, "function_hash": "38789076008487204852921650890027503420" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-8911ae14", "signature_type": "Line", "target": { "file": "include/net/ip.h" }, "signature_version": "v1", "digest": { "line_hashes": [ "95234127204925196641234313112438421124", "7042299603213888861287963172380827082", "68792339343917306884442018500182291825", "122765867514623063713607181046248882917" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-9bf9e670", "signature_type": "Function", "target": { "file": "net/ipv4/icmp.c", "function": "icmp_reply" }, "signature_version": "v1", "digest": { "length": 1536.0, "function_hash": "120635302108761042719818630971137508064" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-a30a097d", "signature_type": "Function", "target": { "file": "net/ipv6/icmp.c", "function": "icmpv6_global_allow" }, "signature_version": "v1", "digest": { "length": 202.0, "function_hash": "31984292375565991399279706478536334968" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-a64e452d", "signature_type": "Function", "target": { "file": "net/ipv6/icmp.c", "function": "icmpv6_echo_reply" }, "signature_version": "v1", "digest": { "length": 2770.0, "function_hash": "240762154268214218024871030327211335445" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-c494cccb", "signature_type": "Function", "target": { "file": "net/ipv4/icmp.c", "function": "icmp_global_allow" }, "signature_version": "v1", "digest": { "length": 745.0, "function_hash": "170002126563272727517376624935234947298" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-ca571b7a", "signature_type": "Function", "target": { "file": "net/ipv4/icmp.c", "function": "icmpv4_global_allow" }, "signature_version": "v1", "digest": { "length": 224.0, "function_hash": "124514994575895714964903850016089759681" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-d34fbe07", "signature_type": "Line", "target": { "file": "net/ipv4/icmp.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "7974403597429537673795661036634101249", "20519213145497325916183627606294734062", "17447443700363339402551470227689735138", "296564488375893405381535228120021788088", "98128499954066698973839131626632120353", "315607055423707918087850627359556332628", "163913056625793112109650011569155398386", "210684640381025930440861970689826949797", "209938629944047462960407534985341434993", "189584189328763105606812574013527986862", "219279883645223152856855520708629686990", "260946727253605775012643380270101929034", "107192419104603665219108246321241802287", "49766371777664155365799820779088770602", "48309742318736017534087470671805760656", "167024330954207868783536326747388547007", "209440161660466702635427372521122323552", "270020373719400541792604587776643996616", "151630839119714804290510179610084937372", "266035784770244038542582448673818084430", "135371024197142063999613069477466936845", "40285248967818732941373677472695462107", "25266885271180087585429236912370679878", "43882331029379761957608455873564726597", "266376276978071300368664563437531110109", "166375406175890951032559230798131157868", "146445718196022734609394506202262734459", "136249630275847807844105914212194399839", "252808914745042278190455019367845224403", "144457857860380893419737855997828271850", "121488524879934060229893982975231275993", "192588488914610685294233487064961371971", "77355982829899235313519199387537092864", "332177827832444365135031045941044176730", "11833581271987137421761828749866751682", "212501915870443770908936391449511829949", "245656282364110851713373490815090481104", "123372323795424801946110363351168435321", "121508903648837370250290007501569340715", "215031971114828754013929126191524110477", "180128977071963505823310678525042425206", "294259478002175417532117224643331303475", "30077527803713098293261738055554396278", "249973482290032730248919894254370764045", "101701359409798882129372676499844887751", "75572692427808712408365909349747986491", "65779763422737817635007457122529123129", "217396345485527856893121664335484141270", "155426798784445868429201316399367534574", "195282085850294806805816215722435531082", "227310325344186566304262764849853774676", "184943710687615040063577291302868916492", "220163164036089379583703276305185790296", "284598146849651960104180139954193692116", "103894897268797169181205272960539716742", "281255442555400721527149387771359663574", "238638628328512820671003936461403968827", "237621945954874758933498802633100380132", "206181217557801876242568637638329720854", "254571909844436432114695384108716328159", "143891071126286407464563865309740923084", "300250652724623792212866989159953649487", "9427155373355698524131965535864762475", "291686912883987540763814230831093571604", "212859238454553642031342303385358988478", "65380841030895920355803566232627943362", "26490911340731485448925450751270556167", "314363860658720121835421539710407215629", "101081603734954661411764721076066986572", "291726333156433164056588097037823789637", "251298740829713203622225790582677899895", "45985914503814489017415578004473937561", "262889070543040099634091005519472435453", "247908127630072672537218898742000855756", "225811700964669058352417348786184205742", "80948108657830364331001176734099686331", "196573743453536900243402242541680126705", "104714901954354567575646408576984772748", "17084654427380708362230595944648685181", "334565824891405006600949771383488186965", "146401796323983051582167691297543175022", "37008477429960698537443810162324917576", "338950574301420898346662914339256259704", "283785776173617751289327407054528483213", "119847936109807909187164008991448809475", "38101393425209210404829996596236219406", "22131158519420935553439024075442527640" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "id": "CVE-2024-47678-e67f319a", "signature_type": "Function", "target": { "file": "net/ipv6/icmp.c", "function": "icmpv6_xrlim_allow" }, "signature_version": "v1", "digest": { "length": 825.0, "function_hash": "103801316918873904355199235991251160403" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@662ec52260cc07b9ae53ecd3925183c29d34288b" } ] }