net: avoid potential underflow in qdisc_pkt_len_init() with UFO
In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in qdisc_pkt_len_init() with UFO After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet. Then commit cf9acc90c80ec ("net: virtio_net_hdr_to_skb: count transport header in UFO") while fixing one issue, allowed user space to cook a GSO packet with the following characteristic : IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28. When this packet arrives in qdisc_pkt_len_init(), we end up with hdr_len = 28 (IPv4 header + UDP header), matching skb->len Then the following sets gso_segs to 0 : gso_segs = DIV_ROUND_UP(skb->len - hdr_len, shinfo->gso_size); Then later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/ qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; This leads to the following crash in fq_codel [1] qdisc_pkt_len_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel. This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug. [1] [ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel mode [ 70.724561] #PF: error_code(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70
CVE-2024-49949
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-49949
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "960b360ca7463921c1a6b72e7066a706d6406223",
"lessThan": "d70ca7598943572d5e384227bd268acb5109bf72",
"versionType": "git"
},
{
"status": "affected",
"version": "fb2dbc124a7f800cd0e4f901a1bbb769a017104c",
"lessThan": "1598d70ad9c7d0a4d9d54b82094e9f45908fda6d",
"versionType": "git"
},
{
"status": "affected",
"version": "8e6bae950da9dc2d2c6c18b1c6b206dc00dc8772",
"lessThan": "ba26060a29d3ca1bfc737aa79f7125128f35147c",
"versionType": "git"
},
{
"status": "affected",
"version": "0f810d06b507aa40fef8d1ac0a88e6d0590dbfc3",
"lessThan": "939c88cbdc668dadd8cfa7a35d9066331239041c",
"versionType": "git"
},
{
"status": "affected",
"version": "cf9acc90c80ecbee00334aa85d92f4e74014bcff",
"lessThan": "d6114993e0a89fde84a60a60a8329a571580b174",
"versionType": "git"
},
{
"status": "affected",
"version": "cf9acc90c80ecbee00334aa85d92f4e74014bcff",
"lessThan": "25ab0b87dbd89cecef8a9c60a02bb97832e471d1",
"versionType": "git"
},
{
"status": "affected",
"version": "cf9acc90c80ecbee00334aa85d92f4e74014bcff",
"lessThan": "f959cce8a2a04ce776aa8b78e83ce339e0d7fbac",
"versionType": "git"
},
{
"status": "affected",
"version": "cf9acc90c80ecbee00334aa85d92f4e74014bcff",
"lessThan": "81fd007dcd47c34471766249853e4d4bce8eea4b",
"versionType": "git"
},
{
"status": "affected",
"version": "cf9acc90c80ecbee00334aa85d92f4e74014bcff",
"lessThan": "c20029db28399ecc50e556964eaba75c43b1e2f1",
"versionType": "git"
},
{
"status": "affected",
"version": "2128303bff700c857739a0af8cc39c1a41840650",
"versionType": "git"
},
{
"status": "affected",
"version": "4.19.218",
"lessThan": "4.19.323",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.162",
"lessThan": "5.4.285",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.82",
"lessThan": "5.10.227",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.5",
"lessThan": "5.15.168",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.14.256",
"lessThan": "4.15",
"versionType": "semver"
}
],
"programFiles": [
"net/core/dev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.323",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.285",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.227",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.168",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.113",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.55",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.14",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11.3",
"versionType": "semver",
"lessThanOrEqual": "6.11.*"
},
{
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/dev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-49949
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26758 · Revision 1
- Added to Heist Feed
- Publisher date