Linux Kernel TCP ISN Leak Vulnerability Allows ISN Prediction

A vulnerability in the Linux kernel's TCP implementation can lead to predictable Initial Sequence Numbers (ISN) by leaking stale per-CPU TCP TIME_WAIT-derived ISN values. This issue arises because the ISN is moved to a per-CPU variable, with the assumption that it will be immediately consumed by the tcp_conn_request() function. However, several drop paths can interrupt this process, leaving the ISN value set. When the next SYN packet is processed on the same CPU, the non-zero ISN is used, creating a potential for ISN prediction. The vulnerability affects the stable versions of the Linux kernel.

Impact

The vulnerability allows for ISN prediction, which can be exploited in TCP connection requests, potentially leading to unauthorized access or manipulation of network connections.

Reproduction

The vulnerability can be reproduced by sending SYN packets that trigger the drop paths mentioned in the vulnerability description, such as those checked by xfrm policies or TCP filters. This can be done using network tools that manipulate packet headers or by configuring the system to drop certain types of TCP traffic.

Remediation

Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been addressed.