Ubuntu
linux-bluefield package

nft_lookup crash when running DDOS attack

Bug #2006397 reported by Bodong Wang
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-bluefield (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
Medium
Bodong Wang

Bug Description

* Explain the bug

Running DDOS test on tcp port 22 will trigger kernel crash.

* Brief explanation of fixes
Do not update stateful expressions if lookup is inverted

* How to test

Configuration nftables with config file below:

flush ruleset
table inet filter {
  chain input {
   type filter hook input priority 0
   jump filter_ssh
}
chain filter_ssh {
   tcp dport { 22 } ct state new accept
}
}

   * {22}: {} is mandatory to repro
If we don’t add {}, nft_lookup_eval function is never called and kernel crush isn’t reproduced.

Then apply nft by doing:
# nft -f temp_nftables.conf

Start hping3 from peer:
# hping3 -I {Host Device} -p 22 -d 52 {SmartNIC IP Address} --flood

DPU side will crash with kernel call trace without this fix.

Stefan Bader (smb)
Changed in linux-bluefield (Ubuntu Focal):
assignee: nobody → Bodong Wang (bodong-wang)
importance: Undecided → Medium
status: New → In Progress
Changed in linux-bluefield (Ubuntu):
status: New → Invalid
Bartlomiej Zolnierkiewicz (bzolnier)
Changed in linux-bluefield (Ubuntu Focal):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-bluefield/5.4.0-1058.64 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-focal-linux-bluefield verification-needed-focal
Revision history for this message
dann frazier (dannf) wrote :

This issue only impacts linux-bluefield/focal because it uniquely included a backport of upstream commit 339706bc21c1 ("netfilter: nft_lookup: update element stateful expression") from v5.7-rc1 without these follow up fixes that also landed in upstream before v5.7 final:

24791b9aa1ab0 netfilter: nft_set_bitmap: initialize set element extension in lookups
a26c1e49c8e97 netfilter: nf_tables: do not update stateful expressions if lookup is inverted

It impacts all linux-bluefield/focal kernels since the initial version, 5.4.0-1001.2 and is resolved in 5.4.0-1058.64.

Revision history for this message
Seth Arnold (seth-arnold) wrote :

Thanks Dann, please use CVE-2023-0881 for this issue.

Thanks

Khoa Vo (khoadvo)
tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (30.0 KiB)

This bug was fixed in the package linux-bluefield - 5.4.0-1058.64

---------------
linux-bluefield (5.4.0-1058.64) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1058.64 -proposed tracker (LP: #2006592)

  * nft_lookup crash when running DDOS attack (LP: #2006397)
    - netfilter: nf_tables: constify nft_reg_load{8, 16, 64}()
    - netfilter: nft_set_bitmap: initialize set element extension in lookups
    - netfilter: nf_tables: do not update stateful expressions if lookup is
      inverted

linux-bluefield (5.4.0-1057.63) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1057.63 -proposed tracker (LP: #2003464)

  * Focal update: v5.4.221 upstream stable release (LP: #1997993)
    - [Config] bluefield: Enable ARM64_ERRATUM_1742098 config on arm64

  * mlxbf-pmc counters not functional for llt_miss block (LP: #2004235)
    - SAUCE: mlxbf-pmc: Bug fix for BlueField-3 counter offsets

  * Add support for CT accounting stats (LP: #1998938)
    - netfilter: conntrack: export nf_ct_acct_update()
    - netfilter: flowtable: add counter support
    - net/sched: act_ct: update nf_conn_acct for act_ct SW offload in flowtable
    - net/sched: act_ct: enable stats for HW offloaded entries

  * allow per-net notifier to follow netdev into namespace (LP: #2002361)
    - net: push loops and nb calls into helper functions
    - net: introduce per-netns netdevice notifiers
    - net: push code from net notifier reg/unreg into helpers
    - net: introduce dev_net notifier register/unregister variants

  * mlxbf-pmc support for BlueField-3 (LP: #2002501)
    - SAUCE: mlxbf-pmc: Support for BlueField-3 performance counters

  * Kernel crash due to Bluefield pka TRNG ioctl call (LP: #2001564)
    - SAUCE: mlxbf-pka: Fix kernel crash with pka TRNG ioctl call

  * mlxbf-pmc: Fix event string typo (LP: #1998863)
    - SAUCE: mlxbf-pmc: Fix event string typo

  [ Ubuntu: 5.4.0-139.156 ]

  * focal/linux: 5.4.0-139.156 -proposed tracker (LP: #2003486)
  * Revoke & rotate to new signing key (LP: #2002812)
    - [Packaging] Revoke and rotate to new signing key

  [ Ubuntu: 5.4.0-138.155 ]

  * focal/linux: 5.4.0-138.155 -proposed tracker (LP: #2001845)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
  * Focal update: v5.4.224 upstream stable release (LP: #1999273)
    - RDMA/cma: Use output interface for net_dev check
    - IB/hfi1: Correctly move list in sc_disable()
    - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors
    - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot
    - nfs4: Fix kmemleak when allocate slot failed
    - net: dsa: Fix possible memory leaks in dsa_loop_init()
    - RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
    - RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
    - nfc: s3fwrn5: Fix potential memory leak in s3fwrn5_nci_send()
    - nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
    - net: fec: fix improper use of NETDEV_TX_BUSY
    - ata: pata_legacy: fix pdc20230_set_piomode()
    - net: sched: Fix use after free in red_enqueue()
    - net: tun: fix bugs for oversize packet when napi frags enabled
    - netfilter: nf_tables: release flow ru...

Changed in linux-bluefield (Ubuntu Focal):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.