GNU C Library getaddrinfo() Flaw

Question

As you probably already know, this Tuesday a potentially catastrophic flaw has been identified on glibc function called getaddrinfo(), which performs domain name lookups, contains a buffer overflow bug(see the link here).

The consequences of this seem to be quiet horrific and it will take time to even have an overview on the size of the list of vulnerable hardware and software which uses this library.

While the extension of the damage and the fixes to follow will hopefully come sooner rather than later, there are some mitigation's which may prevent the attack advised by Google researchers:

Google has found some mitigations that may help prevent exploitation if you are not able to immediately patch your instance of glibc. The vulnerability relies on an oversized (2048+ bytes) UDP or TCP response, which is followed by another response that will overwrite the stack. Our suggested mitigation is to limit the response (i.e., via DNSMasq or similar programs) sizes accepted by the DNS resolver locally as well as to ensure that DNS queries are sent only to DNS servers which limit the response size for UDP responses with the truncation bit set.*

And Glibc maintainers provide the following mitigations:

Mitigating factors for UDP include:

• A firewall that drops UDP DNS packets > 512 bytes.

• A local resolver (that drops non-compliant responses).

• Avoid dual A and AAAA queries (avoids buffer management error) e.g. Do not use AF_UNSPEC.

• No use of options edns0 in /etc/resolv.conf since EDNS0 allows responses larger than 512 bytes and can lead to valid DNS responses that overflow.

• No use of RES_USE_EDNS0 or RES_USE_DNSSEC since they can both lead to valid large EDNS0-based DNS responses that can overflow.

Mitigating factors for TCP include:

• Limit all replies to 1024 bytes.

At the moment I am trying to find a way to limit the size of responses via iptables and the use of the limit module. But so far I have only found ways to use the rate-limits which are not applicable here. Any ideas how this could be translated into an iptables rule(s)?

I am also currently looking into how to have a dns resolver to drop non-compliant responses, so any thoughts/ideas are most welcome.

Answer 1

trying to find a way to limit the size of responses via iptables and the use of the limit module

What you probably need is the iptables length module which can match packets which have a specific length (or range). See http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.html#toc3.7.

Note that this only helps with UDP where the full payload is contained in a single message (you should drop fragmented UDP packets though). With TCP the response can be transferred using multiple packets and a single TCP stream can also contain multiple requests and responses. Thus limiting the length of a packet will not help much.

I am also currently looking into how to have a dns resolver to drop non-compliant responses, so any thoughts/ideas are most welcome.

The best would be to have a application level gateway which sanitizes responses, i.e. a local DNS server which gets accessed from the resolver library. Something like dnsmasq could help although I'm not sure if dnsmasq really sanitizes responses enough for this specific case. Other options would be setting up unbound or bind, although bind has a bad history regarding security itself.