Re: IPv4 fragmentation --> The Rose Attack

From: Paul Starzetz (ihaquer_at_isec.pl)
Date: 04/08/04

  • Next message: Vincenzo Ciaglia: "LNSA-#2004-0010: login may leak sensitive data" 
    Date: Thu, 8 Apr 2004 17:24:57 +0200 (CEST)
To: bugtraq@securityfocus.com

    gandalf@digital.net wrote:

    >The attack is simple. Two parts of a fragmented packet are sent to the
    >machine being attacked. The first fragment (payload 32 bytes long) is the
    >initial offset zero fragment of a SYN packet. The final (second) fragment
    >of the SYN packet is also 32 bytes in size, but is set to an offset of 64800
    >bytes into the datagram.

    There is a similar fragmentation attack which works pretty nice for Linux.
    From the source code of ip_fragment.c follows that the worst case is if
    you send small fragments of a datagram beginning from 0 to lets say 60000
    in pieces of 8 bytes each. This will cause the defragmentation code to
    build a linear list of socket buffers. If you now continue to send the last
    fragment, the kernel will cycle over that list over and over, for every
    packet and finally kfree the last fragment and replace it by the new one.

    That causes a really nice load... It killed at least a 2.4.25 running on
    an Athlon 850. 

    -- 
Paul Starzetz
iSEC Security Research
http://isec.pl/
  • Next message: Vincenzo Ciaglia: "LNSA-#2004-0010: login may leak sensitive data"

    Relevant Pages

    • Re: Juniper ScreenOS DF Bit
      ... Es macht Sinn dass das herumpfuschen am DF-Bit vom Standard her verboten ist. ... An internet datagram can be marked "don't fragment." ... If the Don't Fragment flag bit is set, ...
      (de.comp.security.firewall)
    • Re: Juniper ScreenOS DF Bit
      ... Es macht Sinn dass das herumpfuschen am DF-Bit vom Standard her verboten ist. ... An internet datagram can be marked "don't fragment." ... If the Don't Fragment flag bit is set, ...
      (de.comp.security.firewall)
    • Re: `belong and `belong to question
      ... datagram a newly arrived fragment belongs to." ... another sentences states "The Fragment Offset tells where in the ...
      (alt.usage.english)
    • Re: Drawbacks of sending UDP packets larger than MTU?
      ... I know that, contrary to TCP, UDP ... UDP makes no attempt to either segment or fragment its ... If one fragment of an IP datagram is lost, ...
      (comp.os.linux.networking)
    • Re: Two minor IPFW-related questions
      ... 'outside' the firewall support path MTU discovery *and* have it turned ... Fragmentation requires that each fragment ... the last fragment of a datagram), so the first fragment will generally ... Non-final fragments also have the 'more fragments' flag set in their IP ...
      (freebsd-questions)