Kernel patches close UDP port side channel in routing caches
Always creating exceptions for ICMP errors stops off-path attackers from probing connected UDP sockets after earlier defenses were bypassed.
Ido Schimmel has submitted Linux kernel networking patches that close a side channel off-path attackers could use to discover ephemeral ports on connected UDP sockets.
When the kernel delivers an ICMP error that quotes a UDP packet, it previously created a routing exception for path MTU or redirect information only if that packet matched an existing socket. Cache occupancy and exception contents therefore leaked whether a given port was live. Earlier work switched the IPv4 and IPv6 exception caches to stronger hashing and randomized how many entries a bucket could hold. Amit Klein and Noam Caspi showed both mitigations can be bypassed.
The new approach always creates an exception, using the same helpers as when the quoted packet did not come from a local socket. The resulting entry is indistinguishable whether matching succeeded or failed. Exceptions are also created for sockets that decline path MTU updates, so a missing entry no longer signals that a socket exists. Attackers gain no new way to fill the caches, because the same helpers were already reachable with little validation.
A related fix ensures IPv6 redirect exceptions are created for UDP and raw sockets that are unbound or bound to a VRF. Selftests cover both address families for PMTU and redirect cases. Eric Dumazet and David Ahern reviewed the series, which is marked for stable kernels.