Linux Kernel Traffic Control Vulnerability Analysis

1/31/2023

This post details a specific kernel bug (CVE-2022-47929) where assigning a 'noqueue' qdisc to a classful qdisc (like HTB) in Linux Traffic Control leads to a NULL pointer dereference and a denial-of-service attack. It explains how USER namespaces can be leveraged to trigger this bug by unprivileged users, demonstrating the exploit with shell commands and virtual interfaces. The post also analyzes the root cause, tracing it back to a commit that allowed 'noqueue' to be registered without the previous tx_queue_len=0 hack, and discusses potential solutions, ultimately leading to the chosen fix of disallowing 'noqueue' for qdisc classes.

1/16/2023

This post details a debugging investigation into corrupt packets observed in Cloudflare's flowtrackd system, which utilizes AF_XDP for high-performance networking. The root cause was identified as a descriptor being inserted into AF_XDP rings twice, leading to data corruption. The investigation involved logging packet bytes, analyzing length mismatches between XDP metadata and descriptor lengths, and tracking descriptor addresses to pinpoint the issue. The post also references the AF_XDP documentation that warns against this exact problem, suggesting user error rather than a kernel bug.

7/18/2022

This post details a debugging journey and fix for a crash occurring when creating multiple AF_XDP sockets within different network namespaces. The root cause was identified as AF_XDP not being network namespace aware, specifically when interface index numbers conflicted. A fix was implemented by ensuring unique interface index numbers, allowing the shared UMEM feature to function correctly.

11/3/2021

This post details the debugging process of a Linux kernel crash triggered by a single malformed network packet. It focuses on the `skb_gso_transport_seglen` function and the calculation of inner TCP header lengths, identifying a potential issue with the `doff` field in the inner TCP header. The analysis involves decoding kernel oops reports, disassembling machine code, and examining CPU register states to pinpoint the exact memory access that caused the page fault. The investigation highlights the complexities of Generic Segmentation Offload (GSO) packets and encapsulated traffic, emphasizing the need for robust error handling and data validation within the network stack.

5/18/2019

This post details Cloudflare's use of eBPF and XDP for DoS mitigation and layer 4 load balancing on their edge servers. It highlights the challenges encountered, such as the lack of concurrency primitives (now addressed by bpf_spin_lock) and limitations in eBPF verifier for socket filters. It also discusses the use of iptables with xt_bpf for application layer mitigations and the use of SO_ATTACH_BPF for single UDP socket filters. A new project involving socket lookup from XDP for load balancing is also introduced, along with a corner case related to SYN-cookies and ACK validation.

3/29/2018

This post details the use of eBPF, specifically SO_ATTACH_BPF, to extract IP TTL values from TCP connections. It explains the limitations of traditional methods like libpcap/tcpdump and IP_RECVTTL for TCP sockets. The article then introduces eBPF maps as a mechanism for sharing data between kernel and userspace, and demonstrates how to write eBPF assembly manually to read TTLs and store them in a hash map. It covers BPF calling conventions, accessing packet payloads with BPF_LD, and the use of eBPF maps for data sharing.