In the Linux kernel, the following vulnerability has been resolved:
net: add more sanity checks to qdiscpktlen_init()
One path takes care of SKBGSODODGY, assuming skb->len is bigger than hdr_len.
virtionethdrtoskb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.
It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.
virtionethdrtoskb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.
We need to make detect this case to not underflow qdiscskbcb(skb)->pkt_len.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27a8fabc54d2f960d47bdfbebf2bdc6e8a92a4c4",
"signature_type": "Function",
"id": "CVE-2024-49948-005e1f93",
"digest": {
"function_hash": "72524139528469168095418535563292277654",
"length": 814.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0ee571d20a238a22722126abdfde61f1b2bdd0",
"signature_type": "Line",
"id": "CVE-2024-49948-07b0d73e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566a931a1436d0e0ad13708ea55479b95426213c",
"signature_type": "Line",
"id": "CVE-2024-49948-27ea9ccd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@473426a1d53a68dd1e718e6cd00d57936993fa6c",
"signature_type": "Line",
"id": "CVE-2024-49948-294d5a38",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab9a9a9e9647392a19e7a885b08000e89c86b535",
"signature_type": "Function",
"id": "CVE-2024-49948-3054eec6",
"digest": {
"function_hash": "297766271516875830168321281812223667793",
"length": 763.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab9a9a9e9647392a19e7a885b08000e89c86b535",
"signature_type": "Line",
"id": "CVE-2024-49948-47485ec2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff1c3cadcf405ab37dd91418a62a7acecf3bc5e2",
"signature_type": "Line",
"id": "CVE-2024-49948-5cdd6413",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0ee571d20a238a22722126abdfde61f1b2bdd0",
"signature_type": "Function",
"id": "CVE-2024-49948-5d2c436d",
"digest": {
"function_hash": "297766271516875830168321281812223667793",
"length": 763.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7d1a28f5dd57b4d83def876f8d7b4403bd37df9",
"signature_type": "Line",
"id": "CVE-2024-49948-5e88d725",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff1c3cadcf405ab37dd91418a62a7acecf3bc5e2",
"signature_type": "Function",
"id": "CVE-2024-49948-766ba87c",
"digest": {
"function_hash": "297766271516875830168321281812223667793",
"length": 763.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1eebe602a8d8264a12e35e39d0645fa88dbbacdd",
"signature_type": "Line",
"id": "CVE-2024-49948-90de1b64",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@566a931a1436d0e0ad13708ea55479b95426213c",
"signature_type": "Function",
"id": "CVE-2024-49948-935f606d",
"digest": {
"function_hash": "72524139528469168095418535563292277654",
"length": 814.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27a8fabc54d2f960d47bdfbebf2bdc6e8a92a4c4",
"signature_type": "Line",
"id": "CVE-2024-49948-c4ff7b83",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2415f465730e48b6e38da1c7c097317bf5dd2d20",
"signature_type": "Function",
"id": "CVE-2024-49948-f26eef1c",
"digest": {
"function_hash": "72524139528469168095418535563292277654",
"length": 814.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@473426a1d53a68dd1e718e6cd00d57936993fa6c",
"signature_type": "Function",
"id": "CVE-2024-49948-f4e7162a",
"digest": {
"function_hash": "72524139528469168095418535563292277654",
"length": 814.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7d1a28f5dd57b4d83def876f8d7b4403bd37df9",
"signature_type": "Function",
"id": "CVE-2024-49948-fa51f984",
"digest": {
"function_hash": "149780154973416111790192612479732312746",
"length": 792.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1eebe602a8d8264a12e35e39d0645fa88dbbacdd",
"signature_type": "Function",
"id": "CVE-2024-49948-ff64ded4",
"digest": {
"function_hash": "297766271516875830168321281812223667793",
"length": 763.0
},
"signature_version": "v1",
"target": {
"function": "qdisc_pkt_len_init",
"file": "net/core/dev.c"
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2415f465730e48b6e38da1c7c097317bf5dd2d20",
"signature_type": "Line",
"id": "CVE-2024-49948-ffd481f5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"309332537712220695098791585914050236756",
"100071107637844034718878829598982712457",
"24352595596191021002639898759819134127",
"245202816566818530522161919020746105365",
"335075542938028908955782796797834530353",
"111977515030731877550445691980903433316"
]
},
"signature_version": "v1",
"target": {
"file": "net/core/dev.c"
},
"deprecated": false
}
]