Home page logo

oss-sec logo oss-sec mailing list archives

Re: Linux kernel handling of IPv6 temporary addresses
From: Greg KH <gregkh () linuxfoundation org>
Date: Wed, 14 Nov 2012 09:14:11 -0800

On Wed, Nov 14, 2012 at 10:43:22AM +0200, George Kargiotakis wrote:
Hello all,

Due to the way the Linux kernel handles the creation of IPv6 temporary
addresses a malicious LAN user can remotely disable them altogether
which may lead to privacy violations and information disclosure.

By default the Linux kernel uses the 'ipv6.max_addresses' option to
specify how many IPv6 addresses an interface may have. The
'ipv6.regen_max_retry' option specifies how many times the kernel will
try to create a new address.

Currently, in net/ipv6/addrconf.c,lines 898-910, there is no
distinction between the events of reaching max_addresses for an
interface and failing to generate a new address. Upon
reaching any of the above conditions the following error is emitted by
the kernel times 'regen_max_retry' (default value 3): 

[183.793393] ipv6_create_tempaddr(): retry temporary address
regeneration [183.793405] ipv6_create_tempaddr(): retry temporary
address regeneration [183.793411] ipv6_create_tempaddr(): retry
temporary address regeneration

After 'regen_max_retry' is reached the kernel completely disables
temporary address generation for that interface.

[183.793413] ipv6_create_tempaddr(): regeneration time exceeded -
disabled temporary address support

RFC4941 3.3.7 specifies that disabling temp_addresses MUST happen upon
failure to create non-unique addresses which is not the above case.
Addresses would have been created if the kernel had a higher
'ipv6.max_addresses' limit.

A malicious LAN user can send a limited amount of RA prefixes and thus
disable IPv6 temporary address creation for any Linux host. Recent
distributions which enable the IPv6 Privacy extensions by default, like
Ubuntu 12.04 and 12.10, are vulnerable to such attacks.

Due to the kernel's default values for valid (604800) and preferred
(86400) lifetimes, this scenario may even occur under normal usage when
a Router sends both a public and a ULA prefix, which is not an uncommon
scenario for IPv6. 16 addresses are not enough with the current default
timers when more than 1 prefix is advertised.

The kernel should at least differentiate between the two cases of
reaching max_addresses and being unable to create new addresses, due to
DAD conflicts for example.

Have you discussed this with the upstream Linux kernel networking


greg k-h

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]