NetworkManager IPv6 DAD lifetime behavior introduce security risk

[David Chen]

Description:
When performing IPv6 certification test, two DAD test cases (3.2.5c and d) check the remaining lifetime feature of the IPv6 packets. The Network trace shows that the remaining lifetime becomes infinite when running these test cases. Hence when running in IPv6 environment with Network Manager enabled, there is a risk of packets travelling in network which has valid lifetime always. If these packets are snooped by a hacker he can reply to these packets and they can send legitimate packets which are actually not.

According to https://tools.ietf.org/search/rfc4862, page 19:
"The above rules address a specific denial-of-service attack in which a bogus advertisement could contain prefixes with very small Valid Lifetimes. Without the above rules, a single unauthenticated advertisement containing bogus Prefix Information options with short Valid Lifetimes could cause all of a node's addresses to expire prematurely. The above rules ensure that legitimate advertisements (which are sent periodically) will "cancel" the short Valid Lifetimes before they actually take effect."

Other notes:
- 2 test cases pass without NetworkManager.
- Tested with different Linux Desktop Distributions, as long as NetworkManager is running, those DAD test cases fail.

[Bryan Quigley (bryanquigley)]

Hi David,

Thanks for reporting this and helping to make open source software more secure.

What is the "IPv6 certification test"? Can we get access to it or at least the "two DAD test cases (3.2.5c and d)"

What version of Ubuntu/network-manager have been tested? If not tested please test the development release as well and it's n-m of 1.12.4-1ubuntu1.

Does this issue need to be kept private or is it a generally known issue?

Have you reported it to other Linux distros or network-manager upstream (https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues) ?

Thanks!
Bryan

[David Chen (david.chen)]

Hi Bryan,

Here is the information for those 2 cases:

v6LC_3_2_4_C - Prefix Lifetime less than the Remaining Lifetime and the Remaining Lifetime is less than 2 hours
http://fnet.sourceforge.net/ip6_tests/Self_Test_5-0-0/addr.p2/v6LC_3_2_4_C.html

RA_gt2lt2 - Prefix Lifetime less than 2 hours and the Remaining Lifetime is greater than 2 hours
http://fnet.sourceforge.net/ip6_tests/Self_Test_5-0-0/addr.p2/RA_gt2lt2.html

I think I chose private by mistake, and I have changed it to public.
I haven't reported it to other Linux distro or network-manager upstream. If doing so can get more visibility, I will do it.

Thanks and Regards,
-David

[Will Cooke (willcooke)]

Spoke to upstream. They will look in to this and get it fixed. I've asked David to log it upstream and we can link to that here.

We should look at backport the fixes and SRUing to Bionic.

[David Chen (david.chen)]

Upstream issue reported:

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/57

Thanks for looking into it.

[Will Cooke (willcooke)]

Upstream fix: https://github.com/NetworkManager/NetworkManager/pull/228

This will be ported to all supported releases soon, so we should be able to pick that up easily enough.

[David Chen (david.chen)]

Investigation found that DAD timeout for IPv6 seems to be not implemented for network manager [1]. And only support up to IPv4. It looks like a limitation but couldn't find any writing confirmation for this limitation.

[1] https://developer.gnome.org/NetworkManager/stable/settings-ipv6.html

[David Chen (david.chen)]

Thank you Will!
We are running Ubuntu 16.04 with network-manager version 1.2.6, that will be fixed too?

[Will Cooke (willcooke)]

It should be yes, but I'd like to look at the changes needed before going any further. Looking at the diff, it doesnt look too bad for the current version on n-m. With some luck it will be backported by upstream, if not we'll take a look.

Release of Cosmic is next week, so I dont think this will get any traction until that's out the door, but then we will get on the case.

[Sebastien Bacher (seb128)]

The issue was fixed in 1.12.6 which has been uploaded to disco, https://launchpad.net/ubuntu/+source/network-manager/1.12.6-0ubuntu1

[Jeremy Bícha (jbicha)]

This is fixed in Disco; I opened Bionic and Cosmic tasks since the bug needs to be open in some way for it to be tracked.

[Jeremy Bícha (jbicha)]

The bionic fix is included in the upstream 1.10.14 release:
https://launchpad.net/ubuntu/+source/network-manager/1.10.14-0ubuntu1

1.12.6 has the fix for cosmic.

[Sebastien Bacher (seb128)]

SRUing the newer version failed since it changed behaviour in some configuration which created issue for existing users.

There isn't anyone currently working on resolving those issues so it's more realistic to untarget from Bionic.

If the problem really needs to be resolved in that serie best to go through the rls-bb-incoming nomination process again.