Overlapping IPv4, IPv6, and TCP data : exploring errors, test case context and multiple overlaps inside network stacks and NIDSes

Overview & Synopsis

IP fragmentation and TCP segmentation enable the splitting of large data packets into smaller ones. These mechanisms permit full or partial overlaps with different data on the overlapping portions. Reassembly policies, i.e., the data chunk preferences that depend on the overlap types, differ across IPv4, IPv6, and TCP implementations. This can lead to vulnerabilities, as Network Intrusion Detection Systems (NIDSes) may interpret the packet differently from the monitored hosts. The main goal of this thesis is to evaluate to what extent NIDSes are vulnerable to overlap-based attacks. We first propose a new way to model the fragment and segment overlaps to ensure complete testing. We instanciate this model in our tool PYROLYSE and test the reassembly policy of various IP and TCP stack types. We discovered that the policies are much more diverse and complex that described by related works. Suricata, Snort and Zeek NIDSes exhibit reassembly inconsistencies, which make them vulnerable to overlap-based attacks. We also found reassembly errors in five stacks, including one CVE.