CVE-2020-36516: Linux Kernel TCP Session DOS Vulnerability

CVE-2020-36516 Overview

CVE-2020-36516 is a cryptographic vulnerability in the Linux kernel through version 5.16.11 that affects the IP identification (IPID) assignment mechanism. The mixed IPID assignment method, when combined with the hash-based IPID assignment policy, creates a weakness that allows an off-path attacker to inject malicious data into a victim's TCP session or forcibly terminate active TCP connections. This vulnerability represents a significant threat to network security as it enables sophisticated man-in-the-middle style attacks without requiring the attacker to be positioned on the network path between communicating parties.

Critical Impact

Off-path attackers can inject arbitrary data into active TCP sessions or terminate connections without being on the network path, potentially compromising data integrity and availability of network services.

Affected Products

• Linux Kernel (through version 5.16.11)
• NetApp Cloud Volumes ONTAP Mediator
• NetApp E-Series SANtricity OS Controller
• NetApp SolidFire, Enterprise SDS & HCI Storage Node
• NetApp SolidFire & HCI Management Node
• NetApp H-Series Storage/Compute Nodes (H300S, H500S, H700S, H300E, H500E, H700E, H410S, H410C, H610C, H615C, H610S)
• NetApp Bootstrap OS
• NetApp HCI Compute Node

Discovery Timeline

• 2022-02-26 - CVE-2020-36516 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-36516

Vulnerability Analysis

This vulnerability exists in the Linux kernel's implementation of IP packet identification assignment. The Linux kernel employs a mixed IPID assignment strategy that combines both per-connection and globally shared IPID counters with hash-based assignment. The fundamental weakness arises from how these mechanisms interact, creating predictable patterns that an attacker can exploit.

When the kernel generates IP packets, it assigns IPID values using a combination of hash-based calculations and counter increments. The vulnerability allows an attacker to observe IPID values from packets they receive and use this information to infer the state of TCP connections between other parties. By carefully analyzing these patterns, an attacker can determine sequence numbers and craft packets that will be accepted by the victim's TCP stack.

The attack enables two primary exploitation scenarios: first, an attacker can inject malicious data into an existing TCP connection by sending spoofed packets with valid sequence numbers derived from IPID analysis; second, the attacker can craft TCP RST packets to forcibly terminate legitimate sessions, causing denial of service conditions.

Root Cause

The root cause of this vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). The IPID assignment mechanism relies on a hash-based approach that does not provide sufficient entropy or unpredictability. The algorithm's weaknesses allow statistical analysis of observed IPID values to leak information about other TCP connections, fundamentally breaking the isolation that should exist between network sessions.

The hash function used for IPID generation creates correlations between different connections that share underlying state, enabling side-channel inference attacks. This cryptographic weakness in the IPID assignment policy is the core flaw that enables off-path attackers to gain visibility into TCP session states.

Attack Vector

The attack vector is network-based and can be executed by an off-path attacker. Unlike traditional man-in-the-middle attacks that require the attacker to intercept traffic, this vulnerability allows an attacker positioned anywhere on the internet to target TCP sessions between other parties.

The attack proceeds in several phases: First, the attacker establishes connections with the target server to observe IPID values in responses. By sending carefully crafted probe packets and analyzing the IPID values returned, the attacker can detect when the target is communicating with other parties and infer TCP sequence number information. Armed with this knowledge, the attacker can then inject spoofed packets into the victim's TCP session or send RST packets to terminate the connection.

This attack requires the attacker to be able to send spoofed IP packets and receive responses from the target system. The complexity is heightened by the need for precise timing and statistical analysis, but the attack is feasible against persistent TCP connections.

Detection Methods for CVE-2020-36516

Indicators of Compromise

• Unusual patterns of TCP connection resets affecting specific services or hosts
• Detection of spoofed IP packets with sequence numbers that closely match active sessions
• Anomalous IPID value patterns in incoming packets suggesting reconnaissance activity
• Unexpected TCP data injection causing application-level errors or data corruption

Detection Strategies

• Deploy network intrusion detection systems (IDS) with rules to identify TCP session anomalies and potential injection attempts
• Implement TCP sequence number validation monitoring to detect out-of-sequence packet injection attempts
• Enable logging for unexpected TCP RST packets and analyze patterns for coordinated termination attacks
• Monitor for source IP address spoofing attempts at network perimeter devices

Monitoring Recommendations

• Enable comprehensive network flow logging to establish baseline TCP connection patterns
• Configure endpoint detection solutions to alert on suspicious TCP stack behavior
• Implement network segmentation monitoring to detect lateral movement attempts following session hijacking
• Review firewall and IDS logs regularly for signs of reconnaissance probing

How to Mitigate CVE-2020-36516

Immediate Actions Required

• Update Linux kernel to a patched version that addresses the IPID assignment vulnerability
• Apply vendor-specific firmware updates for affected NetApp products
• Implement network-level controls to detect and block spoofed packets
• Review critical TCP-based services and consider additional application-layer encryption

Patch Information

Organizations should update their Linux kernel installations to versions that include fixes for the IPID assignment mechanism. The vulnerability affects kernels through version 5.16.11, and updated kernels with corrected IPID generation should be deployed. For NetApp products, administrators should consult the NetApp Security Advisory for specific firmware and software update guidance.

Additional technical details about the vulnerability mechanism can be found in the ACM Article on Security.

Workarounds

• Enable strict ingress filtering (BCP38/BCP84) at network boundaries to prevent IP address spoofing
• Configure TCP connection timeouts and limits to reduce the window of opportunity for injection attacks
• Deploy application-layer encryption (TLS) for sensitive TCP communications to mitigate data injection risks
• Consider implementing network-level anomaly detection for TCP traffic patterns

# Configuration example - Enable strict reverse path filtering
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter

# Verify reverse path filtering is enabled
sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.default.rp_filter