AZL-52620
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-52620.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-52620
- Upstream
- Published
- 2024-10-21T18:15:16Z
- Modified
- 2026-04-01T05:16:31.208303Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- CVE-2024-49948 affecting package kernel for versions less than 5.15.173.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: add more sanity checks to qdiscpktlen_init()
One path takes care of SKBGSODODGY, assuming skb->len is bigger than hdr_len.
virtionethdrtoskb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.
It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.
- 20 bytes of IPv4 header
- 60 bytes TCP header
- a small gso_size like 8
virtionethdrtoskb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.
We need to make detect this case to not underflow qdiscskbcb(skb)->pkt_len.
- References