veth: convert frag_list skbs before running XDP
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.184, 6.6.153, 6.12.103, 6.18.44, 7.1.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: veth: convert frag_list skbs before running XDP A frag_list skb can reach veth with data_len set but nr_frags zero. veth_convert_skb_to_xdp_buff() only converts skbs that are shared, locked, have frags[], or do not have enough headroom. It later uses skb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and xdp_frags_size. That exposes frag_list data to XDP as if it were stored in frags[], but frags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment metadata, walk an empty fragment entry, and crash in memcpy() from __xsk_rcv(). Route non-linear skbs through skb_pp_cow_data() before exposing them to XDP, and only advertise XDP frags when the resulting skb has frags[]. skb_copy_bits() already handles frag_list input, and skb_pp_cow_data() builds frags[] output with skb_add_rx_frag(), which is the representation XDP multi-buffer expects.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
From 718a18a0c8a67f97781e40bdef7cdd055c430996 · fixed in 0be3632597b8349d43a7dc4244b492dc62a05998; From 718a18a0c8a67f97781e40bdef7cdd055c430996 · fixed in 04958dba44dc795dc79ce2fcbc117821bbbd6542; From 718a18a0c8a67f97781e40bdef7cdd055c430996 · fixed in 5c1c15c540fc45820ce3033c319151ec891bc10a; From 718a18a0c8a67f97781e40bdef7cdd055c430996 · fixed in b24ba0bbffe3e23eb2f6838881c1fabcb29fb9fb; From 718a18a0c8a67f97781e40bdef7cdd055c430996 · fixed in f9c1fff857e93be709c8b52ed1a643f37bd82c66; From 718a18a0c8a67f97781e40bdef7cdd055c430996 · fixed in d0d6415963040c401e7a7e4e482a698ba52448cb
- Linux Linux
5.18
- KernelLinux
From 5.18.0 · fixed in 6.1.184; From 6.2.0 · fixed in 6.6.153; From 6.7.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8