CVE-2024-49979

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-49979
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49979.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-49979
Downstream
Related
Published
2024-10-21T18:02:25Z
Modified
2026-08-12T03:30:42Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
net: gso: fix tcp fraglist segmentation after pull from frag_list
Details

In the Linux kernel, the following vulnerability has been resolved:

net: gso: fix tcp fraglist segmentation after pull from frag_list

Detect tcp gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly.

Valid SKB_GSO_FRAGLIST skbs

  • consist of two or more segments
  • the head_skb holds the protocol headers plus first gso_size
  • one or more frag_list skbs hold exactly one segment
  • all but the last must be gso_size

Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants.

In extreme cases they pull all data into skb linear. For TCP, this causes a NULL ptr deref in __tcpv4_gso_segment_list_csum at tcp_hdr(seg->next).

Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment.

Approach and description based on a patch by Willem de Bruijn.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49979.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c2ea8cab368b9f25b5937a7f07ab1a66e90b8064
Fixed
75733986fcb0725c0033cde94764389e287b331e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1f2b859225eb8d1ec974214ce4a581f8c528ae57
Fixed
e19201b0c67da5146eaac06fd3d44bd7945c3448
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bee88cd5bd83d40b8aec4d6cb729378f707f6197
Fixed
3fdd8c83e83fa5e82f1b5585245c51e0355c9f46
Fixed
2d4a83a44428de45bfe9dccb0192a3711d1097e0
Fixed
17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49979.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.10.0
Fixed
6.10.14
Type
ECOSYSTEM
Events
Introduced
6.11.0
Fixed
6.11.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-49979.json"