[PATCH 0/1] net/ipv4: discard icmp timestamp requests

If you google "CVE-1999-0524 fix" you'll see quite a few comments along the
lines "this recently showed up in vulnerability scans, this is how I fixed
it".  It shows up because in late 2022, the CVSS score for that CVE changed
from 0.0 to 2.1.  There are actually two part to this: one relates to
disclosing address information (which is long gone from linux) and the
other relates to disclosing timestamp information.

This is regarded a a vulnerability because it allows you see the host's
count of the number of milliseconds since midnight.  Indeed, according to
RFC 0792, and back in 1981 it had a potential use for time synchronisation
across hosts.  That early use-case has long since been supplanted by NTP so
you know how many milliseconds there are since midnight: it's the same as
on your host, your smartwatch, your phone and practically any other
computer you care to mention.

It's not as though the ICMP timestamp is an actual vulnerability, it's just
a pain in the neck because world+dog wants to know how to configure
iptables or nft to just discard this, so let's help everyone out by
discarding it in the kernel.

jch

John Haxby (1):
  net/ipv4: discard icmp timestamp requests

 net/ipv4/icmp.c | 42 +-----------------------------------------
 1 file changed, 1 insertion(+), 41 deletions(-)

-- 
2.55.0