NetBSD Security Advisory 2021-001: Predictable ID disclosures in IPv4 and IPv6

[NetBSD Security-Officer <security-officer%netbsd.org@localhost>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

		 NetBSD Security Advisory 2021-001
		 =================================

Topic:		Predictable ID disclosures in IPv4 and IPv6

Version:	NetBSD-current:		affected 
		NetBSD 9.1:		affected
		NetBSD 8.2:		affected

Severity:	Possible data exfiltration from firewalled or NATed networks

Fixed:		NetBSD-current:		March 9, 2021
		NetBSD-9 branch:	March 9, 2021
		NetBSD-8 branch:	March 9, 2021

Please note that NetBSD releases prior to 8.2 are no longer supported.
It is recommended that all users upgrade to a supported release.

Abstract
========

IP ID randomization was not enabled by default and the randomization
algorithms were not strong enough.

Technical Details
=================

1. IPv4 and IPv6 fragment ids were not randomly generated by default. 
   Furthermore the randomization algorithms were not strong enough.
2. The TCP ISS random generation had an information leak.
3. The IPv6 flow label generation algorithm was not strong enough.

Solutions and Workarounds
=========================

For all NetBSD versions, you need to obtain fixed kernel sources, rebuild
and install the new kernel, and reboot the system.

The following revisions fix the issues:

src/sys/netinet/in_var.h                        1.99,1.102
src/sys/netinet/ip6.h				1.30
src/sys/netinet/ip_input.c			1.400
src/sys/netinet/tcp_subr.c			1.285,1.286
src/sys/netinet/tcp_timer.c                     1.96
src/sys/netinet6/ip6_id.c			1.20
src/sys/netinet6/ip6_var.h			1.88

The fixed source may be obtained from the NetBSD CVS repository. The
following instructions briefly summarise how to upgrade your kernel.
In these instructions, replace:

	ARCH	 with your architecture (from uname -m), and
	KERNCONF with the name of your kernel configuration file.

To update from CVS, re-build, and re-install the kernel:

	# cd src
	# cvs update -d -P sys/netinet sys/netinet6
	# ./build.sh kernel=KERNCONF
	# mv /netbsd /netbsd.old
	# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
	# shutdown -r now

For more information on how to do this, see:

	https://www.NetBSD.org/docs/guide/en/chap-kernel.html

Thanks To
=========

Amit Klein for reporting these vulnerabilities and Taylor R. Campbell
for fixing them.

More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at

	https://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2021-001.txt.asc

Information about NetBSD and NetBSD security can be found at

	https://www.NetBSD.org/
	https://www.NetBSD.org/Security/

Copyright 2021, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.
-----BEGIN PGP SIGNATURE-----

iQIcBAEBAgAGBQJgSn73AAoJEIkmHhf170n/jpYQAKzk+vo/CDcYchOk+/wgPhBL
TbG6rxD3xAVD1aH/sz1lviYTBE5i3W+RohJtZtvUAEoSivFuAODw3TYH/S+KWhDY
IyZ1shNICPTqB1dCrgjiQpmOq9fYQ4i0zpGHhvkqWGjWXMnN2nMy37fPvsZ2TvG2
WrwKThptM8Ls6aB+K4Fg0NcHW6ifdvbXY5r2ddXftoT+zsbW9mclfu9spsAHQtLh
I11GedEU7BOsvT/woFW6mG3VsHPUXofaC5BTINEiJq1o/VE9HoRmhp05Ik+NCwCv
BTzLrKmpOkMJzPp3wvOE2TeolyG57rw1LrHHh6Y/Zb4BIJb6mDP03xuaulRvHg/i
D27/p8qvK4lxSVQtwci15TUa45MbW/nAGMgDEPuMHxEAxwqcfZtdlTiCSSSUuVZV
BxBaW6hB1gTpkNxmtMt7H0W09xbfgztQndHlZaWv2vTeOlHHKO6298C43g12PS/M
pGd3XD3e1hrdrxjtfmiA8oZgOqCM6GJdGpaxE6sBWsVHNyNVurgGI1h5orW9OzO1
vuK6iwq8AZtIp5s/IFddbdFyTNGuzc4gdNx/ON9CnuJRTJ5pWEABYH25imf3fcfU
wRqpGwB2oOMdKnQ56o0qMykuSurXbJNM65R3xlijjuZrclt7cr6Kz3uO+zRr0yGM
1MAq4vRQavtS6+04kZiV
=Oxq5
-----END PGP SIGNATURE-----