inetpeer: randomize RB-tree node comparison using SipHash
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's inetpeer subsystem, which tracks peer entries for IP-keyed rate limiting (such as ICMP rate limits), is affected. An off-path attacker could predict the tree layout and force eviction of targeted peer entries, resetting their rate-limit state and allowing them to bypass ICMP rate limits and infer open UDP ports.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk.
Timeline
- CVE published32 days
- Record last updated
Affected versions
- Linux Linux
From b145425f269a17ed344d737f746b844dfac60c82 · fixed in b20e98f0bb668a59abaf7bcf85d75c073e90d352; From b145425f269a17ed344d737f746b844dfac60c82 · fixed in 5f127e3cc9647a8a70db12c65dbd0de473545380; From b145425f269a17ed344d737f746b844dfac60c82 · fixed in 199fcf285e498111e029137d088949bc6c26d578; From b145425f269a17ed344d737f746b844dfac60c82 · fixed in 857681f6835d5b0a7bc4a34a026baeaaf5215623; From b145425f269a17ed344d737f746b844dfac60c82 · fixed in 7109bb63667a53e4542ad845476f97d0c8b28a61; From b145425f269a17ed344d737f746b844dfac60c82 · fixed in 2ee66e9487172fcd189bc52a767c30dad7141c09
- Linux Linux
4.14
- KernelLinux
From 4.14.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6