A Formal Analysis of SCTP: Attack Synthesis and Patch Verification
Jacob Ginesin,Max von Hippel,Evan Defloor,Cristina Nita-Rotaru,Michael Tüxen
2024-03-09
Abstract:SCTP is a transport protocol offering features such as multi-homing,
multi-streaming, and message-oriented delivery. Its two main implementations
were subjected to conformance tests using the PacketDrill tool. Conformance
testing is not exhaustive and a recent vulnerability (CVE-2021-3772) showed
SCTP is not immune to attacks. Changes addressing the vulnerability were
implemented, but the question remains whether other flaws might persist in the
protocol design.
We study the security of the SCTP design, taking a rigorous approach rooted
in formal methods. We create a formal Promela model of SCTP, and define 10
properties capturing the essential protocol functionality based on its RFC
specification and consultation with the lead RFC author. Then we show using the
Spin model checker that our model satisfies these properties. We define 4
attacker models - Off-Path, where the attacker is an outsider that can spoof
the port and IP of a peer; Evil-Server, where the attacker is a malicious peer;
Replay, where an attacker can capture and replay, but not modify, packets; and
On-Path, where the attacker controls the channel between peers. We modify an
attack synthesis tool designed for transport protocols, Korg, to support our
SCTP model and four attacker models.
We synthesize 14 unique attacks using the attacker models - including the CVE
vulnerability in the Off-Path attacker model, 4 attacks in the Evil-Server
attacker model, an opportunistic ABORT attack in the Replay attacker model, and
eight connection manipulation attacks in the On-Path attacker model. We show
that the proposed patch eliminates the vulnerability and does not introduce new
ones according to our model and protocol properties. Finally, we identify and
analyze an ambiguity in the RFC, which we show can be interpreted insecurely.
We propose an erratum and show that it eliminates the ambiguity.
Cryptography and Security