Re: [PATCH net v2 3/4] ipv6: udp: Create exceptions before socket matching

[David Ahern <dsahern@kernel.org>]

On 8/28/26 1:23 PM, Ido Schimmel wrote:
> Currently, when ICMPv6 Packet Too Big and Redirect Message packets are
> locally delivered and quote a UDP packet, an exception is only created
> in the IPv6 exception cache if the kernel can match the UDP packet to an
> existing socket.
> 
> This behavior allows off-path attackers to conduct a side-channel attack
> on the exception cache in order to discover the ephemeral port used by a
> connected UDP socket.
> 
> Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and
> commit a00df2caffed ("ipv6: make exception cache less predictible") tried
> to mitigate such attacks by making it harder for attackers to discover
> hash collisions in the exception cache and by randomizing the number of
> exceptions a hash bucket can hold, respectively. Unfortunately, both of
> the mitigations can be bypassed.
> 
> Instead, mitigate such attacks by always creating an exception, even
> before trying to find a matching socket. Do that by calling
> ip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted
> packet did not originate from a socket.
> 
> This means that guesses (right or wrong) from an off-path attacker will
> always result in an exception being created or updated in the cache that
> the attacker can observe.
> 
> Pass the ifindex of the ingress device and the default uid, in a similar
> fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any
> nexthop in ip6_redirect_nh_match() and no exception would be created in
> response to a Redirect Message.
> 
> Note that this does not allow attackers to create exceptions that they
> could not create before, as both helpers can already be reached with
> little to no validation. For example, by sending an ICMPv6 error that
> quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that
> matches a wildcard socket.
> 
> Also note that in the good case (matched socket) the above scheme comes
> at the cost of an extra route lookup, as the no socket helpers perform
> their own lookup before the one performed by ip6_sk_update_pmtu() /
> ip6_sk_redirect(). When the two resolve to different nexthops, it also
> results in two exceptions being created for the same destination IP. One
> in the exception cache of the nexthop resolved by the no socket helpers
> and another in the exception cache of the nexthop used by the socket.
> 
> Fixes: 2b760fcf5cfb ("ipv6: hook up exception table to store dst cache")
> Cc: stable@vger.kernel.org
> Reported-by: Amit Klein <aksecurity@gmail.com>
> Reported-by: Noam Caspi <noam.caspi@mail.huji.ac.il>
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/ipv6/udp.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>