CVE-2024-49948

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-49948
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49948.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-49948
Downstream
Related
Published
2024-10-21T18:02:05.121Z
Modified
2026-06-18T03:56:35.326585043Z
Summary
net: add more sanity checks to qdisc_pkt_len_init()
Details

In the Linux kernel, the following vulnerability has been resolved:

net: add more sanity checks to qdiscpktlen_init()

One path takes care of SKBGSODODGY, assuming skb->len is bigger than hdr_len.

virtionethdrtoskb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.

It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.

  • 20 bytes of IPv4 header
  • 60 bytes TCP header
  • a small gso_size like 8

virtionethdrtoskb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.

We need to make detect this case to not underflow qdiscskbcb(skb)->pkt_len.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49948.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1def9238d4aa2146924994aa4b7dc861f03b9362
Fixed
d7d1a28f5dd57b4d83def876f8d7b4403bd37df9
Fixed
473426a1d53a68dd1e718e6cd00d57936993fa6c
Fixed
566a931a1436d0e0ad13708ea55479b95426213c
Fixed
2415f465730e48b6e38da1c7c097317bf5dd2d20
Fixed
27a8fabc54d2f960d47bdfbebf2bdc6e8a92a4c4
Fixed
9b0ee571d20a238a22722126abdfde61f1b2bdd0
Fixed
ff1c3cadcf405ab37dd91418a62a7acecf3bc5e2
Fixed
1eebe602a8d8264a12e35e39d0645fa88dbbacdd
Fixed
ab9a9a9e9647392a19e7a885b08000e89c86b535

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49948.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.9.0
Fixed
4.19.323
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.285
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.227
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.168
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.113
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.55
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.10.14
Type
ECOSYSTEM
Events
Introduced
6.11.0
Fixed
6.11.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49948.json"