From: Andrew Morton <akpm@linux-foundation.org>
To: netdev@vger.kernel.org
Cc: "bugme-daemon@kernel-bugs.osdl.org"
<bugme-daemon@bugzilla.kernel.org>,
didier.schrapf@alcatelaleniaspace.com
Subject: Re: [Bugme-new] [Bug 8284] New: IPsec anti-replay window management flaw
Date: Fri, 30 Mar 2007 01:14:50 -0700 [thread overview]
Message-ID: <20070330011450.f981a8ca.akpm@linux-foundation.org> (raw)
In-Reply-To: <200703300806.l2U86HLU019078@fire-2.osdl.org>
On Fri, 30 Mar 2007 01:06:17 -0700 bugme-daemon@bugzilla.kernel.org wrote:
> http://bugzilla.kernel.org/show_bug.cgi?id=8284
>
> Summary: IPsec anti-replay window management flaw
> Kernel Version: 2.6.20.4
> Status: NEW
> Severity: normal
> Owner: shemminger@osdl.org
> Submitter: didier.schrapf@alcatelaleniaspace.com
>
>
> The IPsec ESP/AH anti-replay window size is configurable, 64 being the value
> recommended by RFC 2406.
> Linux kernels use a 32 bit bitmap to check whether a sequence number has
> already been received.
>
> When a packet is received, if its seq is lower than the greatest received seq,
> and if the difference is greater than 32, the check doesn't work.
> This constitutes a security flaw.
>
> The faulty code is in net/xfrm/xfrm-state.c, functions xfrm_replay_check() and
> xfrm_replay_advance().
parent reply other threads:[~2007-03-30 8:15 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <200703300806.l2U86HLU019078@fire-2.osdl.org>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070330011450.f981a8ca.akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=bugme-daemon@bugzilla.kernel.org \
--cc=didier.schrapf@alcatelaleniaspace.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).