Are linux network drivers really affected by this?

Are linux network drivers really affected by this?

[Nils Petter Vaskinn]

http://www.kb.cert.org/vuls/id/412115


Summary: Some network drivers don't pad ethernet packets with nulls,
they are filled with "garbage" often from previously sent packets. Linux
is mentioned as vulnerable.



Nils Petter Vaskinn

Re: Are linux network drivers really affected by this?

[andrea.glorioso]

>>>>> "npv" == Nils Petter Vaskinn <nils.petter.vaskinn@itsopen.net> writes:

    npv> http://www.kb.cert.org/vuls/id/412115


    npv> Summary: Some network drivers don't pad ethernet packets with
    npv> nulls, they are filled with "garbage" often from previously
    npv> sent packets. Linux is mentioned as vulnerable.

The paper presented by Olaf Arkin (amongst other) points to some parts
of the linux code where this "vulnerability" exists.  I think Alan Cox
is working on some patches for his tree.  I wonder whether it's better
to null-pad  ethernet packets  or   to fill  them with  random  values
(possibly an overkill, but more resiliant against fingerprinting).

bye,

andrea
--
Andrea Glorioso                   andrea.glorioso@binary-only.com
Binary Only                           http://www.binary-only.com/
Via A. Zanolini, 7/b                  Tel:     +39-348.921.43.79
40126 Bologna                         Fax:     +39-051-930.31.133

Re: Are linux network drivers really affected by this?

[Alan Cox]

On Fri, 2003-01-10 at 08:08, andrea.glorioso@binary-only.com wrote:
> The paper presented by Olaf Arkin (amongst other) points to some parts
> of the linux code where this "vulnerability" exists.  I think Alan Cox
> is working on some patches for his tree.  I wonder whether it's better
> to null-pad  ethernet packets  or   to fill  them with  random  values
> (possibly an overkill, but more resiliant against fingerprinting).

Most of them will pad with zero. We have a couple of drivers that already
pad with something along the lines of "NetBSD is a cool OS too.."

The -ac tree should have the problem fixed for all the drivers I know have
the problem or may do.

Re: Are linux network drivers really affected by this?

[andrea.glorioso]

>>>>> "ac" == Alan Cox <alan@lxorguk.ukuu.org.uk> writes:

    ac> Most of  them will pad with zero.  We have a couple of drivers
    ac> that already pad with something along  the lines of "NetBSD is
    ac> a cool OS too.."

Let's talk about subliminal messages, then. :)

How sensible would it be to have a runtime or  compile time option for
choosing between zero padding and  random values padding?  I think the
variable length of the  padding could cause some performance problems,
but I'm no kernel hacker nor cryptography expert.

    ac> The -ac tree should have the problem fixed for all the drivers
    ac> I know have the problem or may do.

Great.

bye,

andrea
--
Andrea Glorioso                   andrea.glorioso@binary-only.com
Binary Only                           http://www.binary-only.com/
Via A. Zanolini, 7/b                  Tel:     +39-348.921.43.79
40126 Bologna                         Fax:     +39-051-930.31.133

Re: Are linux network drivers really affected by this?

[Denis Vlasenko]

On 10 January 2003 13:12, andrea.glorioso@binary-only.com wrote:
> >>>>> "ac" == Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
>
>     ac> Most of  them will pad with zero.  We have a couple of
> drivers ac> that already pad with something along  the lines of
> "NetBSD is ac> a cool OS too.."
>
> Let's talk about subliminal messages, then. :)
>
> How sensible would it be to have a runtime or  compile time option
> for choosing between zero padding and  random values padding?  I
> think the variable length of the  padding could cause some
> performance problems, but I'm no kernel hacker nor cryptography
> expert.

Too much work for zero gain
--
vda

Re: Are linux network drivers really affected by this?

[andrea.glorioso]

>>>>> "dv" == Denis Vlasenko <vda@port.imtp.ilyichevsk.odessa.ua> writes:

    dv> Too much work for zero gain 

`Too much work' refers to coding time or to kernel work?  

bye,

andrea
--
Andrea Glorioso                   andrea.glorioso@binary-only.com
Binary Only                           http://www.binary-only.com/
Via A. Zanolini, 7/b                  Tel:     +39-348.921.43.79
40126 Bologna                         Fax:     +39-051-930.31.133

Re: Are linux network drivers really affected by this?

[Denis Vlasenko]

On 10 January 2003 16:53, andrea.glorioso@binary-only.com wrote:
> >>>>> "dv" == Denis Vlasenko <vda@port.imtp.ilyichevsk.odessa.ua>
> >>>>> writes:
>
>     dv> Too much work for zero gain
>
> `Too much work' refers to coding time or to kernel work?

Coding.

IMHO:

Zero padding is secure enough.
There is no point spending time coding random
padding, config options, etc.
--
vda

Re: Are linux network drivers really affected by this?

[andrea.glorioso]

>>>>> "dv" == Denis Vlasenko <vda@port.imtp.ilyichevsk.odessa.ua> writes:

    dv> On 10 January 2003 16:53, andrea.glorioso@binary-only.com
    dv> wrote:
    >> >>>>> "dv" == Denis Vlasenko
    >> <vda@port.imtp.ilyichevsk.odessa.ua> >>>>> writes:
    >> 
    dv> Too much work for zero gain
    >> `Too much work' refers to coding time or to kernel work?

    dv> Coding.

I would have said `kernel work' (although the relative occurrence of
undersized frames is probably low).

    dv> IMHO:

    dv> Zero padding is secure enough.  

Not for fingerprinting, though.

    dv> There is no point spending time coding random padding, config
    dv> options, etc.  

You're probably right.

bye,

andrea
--
Andrea Glorioso                   andrea.glorioso@binary-only.com
Binary Only                           http://www.binary-only.com/
Via A. Zanolini, 7/b                  Tel:     +39-348.921.43.79
40126 Bologna                         Fax:     +39-051-930.31.133

Re: Are linux network drivers really affected by this?

[Miles Bader]

andrea.glorioso@binary-only.com writes:
>     ac> Most of  them will pad with zero.  We have a couple of drivers
>     ac> that already pad with something along  the lines of "NetBSD is
>     ac> a cool OS too.."
> 
> Let's talk about subliminal messages, then. :)

How about `Printer on fire'?

-Miles
-- 
I have seen the enemy, and he is us.  -- Pogo

RE: Are linux network drivers really affected by this?

[Folkert van Heusden]

>     ac> Most of  them will pad with zero.  We have a couple of drivers
>     ac> that already pad with something along  the lines of "NetBSD is
>     ac> a cool OS too.."
>> Let's talk about subliminal messages, then. :)
>How about `Printer on fire'?

I vote for padding with"

"Linus is god!"
Repeating the exclamation-mark as much as needed.


Folkert
www.vanheusden.com