28

I recently read about this Linux TCP flaw (CVE-2016-5696) which allows an attacker to break or hijack a connection between two machines running Linux (for instance a webserver and a client). I understand that the problem was introduced back in 2012 in Linux kernel version 3.6 and affects all newer versions as well.

Currently a fix for this has not been released (as the time of this writing), but are there any workarounds as this is quite a major bug?

  • Ubuntu has not released a fix? Certain other distributions had a fix published before the flaw was made public. – Michael Hampton Aug 14 '16 at 19:47
  • @MichaelHampton: As far as I understand a fix has been made available in the -proposed channel, however a stable release has not yet been made. – user364819 Aug 14 '16 at 21:31
  • I think they are planning to release the fix on the 27th. – user364819 Aug 14 '16 at 21:32
  • @MichaelHampton: I have updated my answer with the relevant information. – user364819 Aug 14 '16 at 21:42
29

Note: The Workaround section has been kept for historical reasons, however please skip down to the Fix section below.

Workaround:

As stated here:

The good news -- and, yes, there is good news -- is it's easy to fix. First, Linux itself is being patched to stop the attack vector in its track. Next, you simply raise the 'challenge ACK limit' to an extremely large value to make it practically impossible to exploit the side channel problem that enabled the attack to work.

As this issue affects both the client and server, or in fact any two Linux machines talking over the network, it is important to implement the workaround in both, and the fix as soon as it is released.

In order to implement the workaround do the following:

  1. Open the config file with: sudoedit /etc/sysctl.conf
  2. Insert the line net.ipv4.tcp_challenge_ack_limit = 999999999 into the file and save it
  3. Run sudo sysctl -p to update the configuration

You can also do the operation directly from Terminal:

sudo bash -c 'echo "net.ipv4.tcp_challenge_ack_limit = 999999999" >>/etc/sysctl.conf'

Or:

echo 'net.ipv4.tcp_challenge_ack_limit = 999999999' | sudo tee -a /etc/sysctl.conf

Then run:

sudo sysctl -p

Fix:

As stated here:

net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly
determine the rate of challenge ACK segments, which makes it easier for
man-in-the-middle attackers to hijack TCP sessions via a blind in-window
attack.
...
sbeattie> fix is going to land in Ubuntu kernels in this SRU cycle,  
with a likely release date of Aug 27. Earlier access to the kernels  
with the fix will be available from the -proposed pocket, though they 
come with the risk of being less tested.

And a fix has now been released:

linux (4.4.0-36.55) xenial; urgency=low

  [ Stefan Bader ]

  * Release Tracking Bug
    - LP: #1612305

  * I2C touchpad does not work on AMD platform (LP: #1612006)
    - SAUCE: pinctrl/amd: Remove the default de-bounce time

  * CVE-2016-5696
    - tcp: make challenge acks less predictable

 -- Stefan Bader <stefan.bader@canonical.com>  Thu, 11 Aug 2016 17:34:14 +0200

Run:

sudo apt-get update
sudo apt-get dist-upgrade

To make sure you have the latest version. Or use the Software Updater if you would prefer to update through the GUI.

You can check which version you are running and which is available with:

apt-cache policy linux-image-generic
  • The fast (but not persistent) fix: echo 999999999 > /proc/sys/net/ipv4/tcp_challenge_ack_limit – Ben Voigt Aug 16 '16 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy