Re: [PATCH net] inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

[David Ahern <dsahern@kernel.org>]

On 2/3/26 12:25 PM, Eric Dumazet wrote:
> Yizhou Zhao reported that simply having one RAW socket on protocol
> IPPROTO_RAW (255) was dangerous.
> 
>   socket(AF_INET, SOCK_RAW, 255);
> 
> A malicious incoming ICMP packet can set the protocol field to 255
> and match this socket, leading to FNHE cache changes.
> 
> inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST")
> pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner
> 
> "man 7 raw" states:
> 
>   A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able
>   to send any IP protocol that is specified in the passed header.
>   Receiving of all IP protocols via IPPROTO_RAW is not possible
>   using raw sockets.
> 
> Make sure we drop these malicious packets.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
> Link: https://lore.kernel.org/netdev/20251109134600.292125-1-zhaoyz24@mails.tsinghua.edu.cn/
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> Cc: Ido Schimmel <idosch@nvidia.com>
> Cc: David Ahern <dsahern@kernel.org>
> ---
>  net/ipv4/icmp.c | 14 ++++++++++----
>  net/ipv6/icmp.c |  6 ++++++
>  2 files changed, 16 insertions(+), 4 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>