In the Linux kernel, the following vulnerability has been resolved:
net: avoid potential underflow in qdiscpktlen_init() with UFO
After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtionethdrtoskb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet.
Then commit cf9acc90c80ec ("net: virtionethdrtoskb: count transport header in UFO") while fixing one issue, allowed user space to cook a GSO packet with the following characteristic :
IPv4 SKBGSOUDP, gso_size=3, skb->len = 28.
When this packet arrives in qdiscpktleninit(), we end up with hdrlen = 28 (IPv4 header + UDP header), matching skb->len
Then the following sets gso_segs to 0 :
gsosegs = DIVROUNDUP(skb->len - hdrlen, shinfo->gso_size);
Then later we set qdiscskbcb(skb)->pkt_len to back to zero :/
qdiscskbcb(skb)->pktlen += (gsosegs - 1) * hdr_len;
This leads to the following crash in fq_codel [1]
qdiscpktlen_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel.
This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug.
[1] [ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel mode [ 70.724561] #PF: errorcode(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991 [ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.724561] RIP: 0010:fqcodelenqueue (net/sched/schfqcodel.c:120 net/sched/schfqcodel.c:168 net/sched/schfqcodel.c:230) schfq_codel [ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49
0: 24 08 and $0x8,%al 2: 49 c1 e1 06 shl $0x6,%r9 6: 44 89 7c 24 18 mov %r15d,0x18(%rsp) b: 45 31 ed xor %r13d,%r13d e: 45 31 c0 xor %r8d,%r8d 11: 31 ff xor %edi,%edi 13: 89 44 24 14 mov %eax,0x14(%rsp) 17: 4c 03 8b 90 01 00 00 add 0x190(%rbx),%r9 1e: eb 04 jmp 0x24 20: 39 ca cmp %ecx,%edx 22: 73 37 jae 0x5b 24: 4d 8b 39 mov (%r9),%r15 27: 83 c7 01 add $0x1,%edi 2a:* 49 8b 17 mov (%r15),%rdx <-- trapping instruction 2d: 49 89 11 mov %rdx,(%r9) 30: 41 8b 57 28 mov 0x28(%r15),%edx 34: 45 8b 5f 34 mov 0x34(%r15),%r11d 38: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 3f: 49 rex.WB
0: 49 8b 17 mov (%r15),%rdx 3: 49 89 11 mov %rdx,(%r9) 6: 41 8b 57 28 mov 0x28(%r15),%edx a: 45 8b 5f 34 mov 0x34(%r15),%r11d e: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 15: 49 rex.WB [ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [ 70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [ 70.724561] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09: ffff95b710a30000 [ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [ 70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [ 70.724561] FS: 000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [ 70.724561] CS: 0010 DS: 0000 ES: 0000 C ---truncated---
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@939c88cbdc668dadd8cfa7a35d9066331239041c",
"id": "CVE-2024-49949-0aab60e2",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"32233561993856318533056918374189833687",
"282746017232645039825273068606295909679"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f959cce8a2a04ce776aa8b78e83ce339e0d7fbac",
"id": "CVE-2024-49949-2790023f",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"171243691094013791766126268143139333435",
"50839083148614927020362695713568461142"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6114993e0a89fde84a60a60a8329a571580b174",
"id": "CVE-2024-49949-34ab661c",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "141071158367985153881760561234278973330",
"length": 774.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25ab0b87dbd89cecef8a9c60a02bb97832e471d1",
"id": "CVE-2024-49949-3de86a7e",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"171243691094013791766126268143139333435",
"50839083148614927020362695713568461142"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1598d70ad9c7d0a4d9d54b82094e9f45908fda6d",
"id": "CVE-2024-49949-4a0a1d67",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"32233561993856318533056918374189833687",
"282746017232645039825273068606295909679"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1598d70ad9c7d0a4d9d54b82094e9f45908fda6d",
"id": "CVE-2024-49949-5a47afb0",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "141071158367985153881760561234278973330",
"length": 774.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba26060a29d3ca1bfc737aa79f7125128f35147c",
"id": "CVE-2024-49949-74b392b2",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"32233561993856318533056918374189833687",
"282746017232645039825273068606295909679"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81fd007dcd47c34471766249853e4d4bce8eea4b",
"id": "CVE-2024-49949-856f8d70",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"171243691094013791766126268143139333435",
"50839083148614927020362695713568461142"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba26060a29d3ca1bfc737aa79f7125128f35147c",
"id": "CVE-2024-49949-9b523935",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "141071158367985153881760561234278973330",
"length": 774.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d6114993e0a89fde84a60a60a8329a571580b174",
"id": "CVE-2024-49949-b0335010",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"32233561993856318533056918374189833687",
"282746017232645039825273068606295909679"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c20029db28399ecc50e556964eaba75c43b1e2f1",
"id": "CVE-2024-49949-be34e4ee",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"171243691094013791766126268143139333435",
"50839083148614927020362695713568461142"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25ab0b87dbd89cecef8a9c60a02bb97832e471d1",
"id": "CVE-2024-49949-c17bb8a1",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "192550566851607080202704321501477174929",
"length": 723.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d70ca7598943572d5e384227bd268acb5109bf72",
"id": "CVE-2024-49949-c913be35",
"target": {
"file": "net/core/dev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"299234275652537286596772336553875949620",
"285736380993720957236120633847351825122",
"32233561993856318533056918374189833687",
"282746017232645039825273068606295909679"
]
},
"signature_version": "v1",
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81fd007dcd47c34471766249853e4d4bce8eea4b",
"id": "CVE-2024-49949-d1bce92e",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "192550566851607080202704321501477174929",
"length": 723.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d70ca7598943572d5e384227bd268acb5109bf72",
"id": "CVE-2024-49949-e6628dbe",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "328895514155190205572970640201463303454",
"length": 752.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c20029db28399ecc50e556964eaba75c43b1e2f1",
"id": "CVE-2024-49949-f913b36e",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "192550566851607080202704321501477174929",
"length": 723.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f959cce8a2a04ce776aa8b78e83ce339e0d7fbac",
"id": "CVE-2024-49949-f92162b3",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "192550566851607080202704321501477174929",
"length": 723.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@939c88cbdc668dadd8cfa7a35d9066331239041c",
"id": "CVE-2024-49949-fb153db5",
"target": {
"file": "net/core/dev.c",
"function": "qdisc_pkt_len_init"
},
"digest": {
"function_hash": "141071158367985153881760561234278973330",
"length": 774.0
},
"signature_version": "v1",
"signature_type": "Function",
"deprecated": false
}
]