Linux Kernel Netfilter SYNPROXY TCP Header Handling Vulnerability

A vulnerability exists in the Linux kernel's netfilter component, specifically within the SYNPROXY feature. The issue arises in the 'synproxy_tstamp_adjust' function, which modifies the TCP timestamp option and updates the TCP checksum. The vulnerability occurs because the function may use a stale pointer to the TCP header, leading to incorrect checksum calculations. This can result in either writing to freed memory or sending a packet with a mismatched checksum, causing potential network communication issues.

Impact

Exploitation of this vulnerability can lead to memory corruption by writing into freed slab memory, or causing a packet to be transmitted with an incorrect checksum that does not align with its payload, potentially disrupting network communication.

Reproduction

To reproduce this vulnerability, enable the SYNPROXY feature in the netfilter component of the Linux kernel. When a TCP packet is processed, the 'synproxy_tstamp_adjust' function will be called. This function will overwrite the TCP timestamp option and attempt to update the TCP checksum. However, due to the way the TCP header pointer is handled, the checksum update will either write into freed memory or into a stack buffer, leaving the on-wire checksum incorrect. This can be observed by monitoring the TCP checksum of packets leaving the system, which will not match the actual payload, causing potential issues with TCP packet integrity.

Remediation

The vulnerability has been addressed in the official Linux kernel repository. Users should upgrade to the latest version of the Linux kernel where this issue has been fixed.