CVE-2021-43267

A flaw was discovered in the cryptographic receive code in the Linux kernel's implementation of transparent interprocess communication. An attacker, with the ability to send TIPC messages to the target, can corrupt memory and escalate privileges on the target system.

The TIPC module will NOT be automatically loaded. When required, administrative action is needed to explicitly load this module.

Loading the module can be prevented with the following instructions:
# echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf
The system will need to be restarted if the tipc module is loaded. In most circumstances, the TIPC kernel module will be unable to be unloaded while any network interfaces are active and the protocol is in use.

If the system requires this module to work correctly, this mitigation may not be suitable.
If you need further assistance, see KCS article https://access.redhat.com/solutions/41278 or contact Red Hat Global Support Services.

To mitigate the issue on systems that do need to use TIPC and do *not* deploy the TIPC protocol level encryption but rather use different ways to ensure secure communication between nodes (eg. physical network separation, IPSec/MACsec):

- BEWARE THAT THIS WILL DISABLE THE TIPC PROTOCOL LEVEL ENCRYPTION -

1) On the host, save the following in a file with the ".stp" extension:

%{

#include <linux/skbuff.h>

#define MSG_CRYPTO 14
#define SOCK_WAKEUP 14 /* pseudo user */
#define TOP_SRV 15 /* pseudo user */

struct tipc_msg {
        __be32 hdr[15];
};

static inline struct tipc_msg *buf_msg(struct sk_buff *skb)
{
        return (struct tipc_msg *)skb->data;
}

static inline u32 msg_word(struct tipc_msg *m, u32 pos)
{
        return ntohl(m->hdr[pos]);
}

static inline void msg_set_word(struct tipc_msg *m, u32 w, u32 val)
{
        m->hdr[w] = htonl(val);
}

static inline u32 msg_bits(struct tipc_msg *m, u32 w, u32 pos, u32 mask)
{
        return (msg_word(m, w) >> pos) & mask;
}

static inline void msg_set_bits(struct tipc_msg *m, u32 w,
                                u32 pos, u32 mask, u32 val)
{
        val = (val & mask) << pos;
        mask = mask << pos;
        m->hdr[w] &= ~htonl(mask);
        m->hdr[w] |= htonl(val);
}

static inline u32 msg_user(struct tipc_msg *m)
{
        return msg_bits(m, 0, 25, 0xf);
}

static inline void msg_set_user(struct tipc_msg *m, u32 n)
{
        msg_set_bits(m, 0, 25, 0xf, n);
}

%}

function sanitize:long (skb:long) %{
        struct sk_buff *skb;
        struct tipc_msg *hdr;

#if STAP_COMPAT_VERSION >= STAP_VERSION(1,8)
        skb = (struct sk_buff *) (unsigned long) STAP_ARG_skb;
#else
        skb = (struct sk_buff *) (unsigned long) THIS->skb;
#endif

        hdr = buf_msg(skb);

        if(msg_user(hdr) == MSG_CRYPTO) {
                msg_set_user(hdr, TOP_SRV); // set to invalid in this context
        }

%}

probe module("tipc").function("tipc_data_input").call {
        sanitize($skb);
}

2) Install the "systemtap" package and any required dependencies (such as
   kernel-devel and kernel-debuginfo packages).

3) Run the "stap -g [filename-from-step-1].stp" command as root.

If the host is rebooted, the changes will be lost and the script must be
run again.

Alternatively, build the systemtap script on a development system with
"stap -g -p 4 [filename-from-step-1].stp", distribute the resulting kernel
module to all affected systems, and run "staprun -L <module>" on those.
When using this approach only systemtap-runtime package is required on the
affected systems. Please notice that the kernel version must be the same across
all systems.