xsk: drain continuation descs after overflow in xsk_build_skb()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.114, 6.18.44, 7.1.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: drain continuation descs after overflow in xsk_build_skb() Fix generic xmit path multi-buffer logic when packets are either too big (count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is included in fragmented packet. Introduce xdp_sock::drain_cont and act upon this flag - when it is set, keep on consuming descriptors from AF_XDP Tx ring and put them directly onto Cq. Previously these descriptors were silently lost and could never be reached again.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From cf24f5a5feeaae34c1a34d1e04f8ac697290427a · fixed in ecd0d1cde0478c232a867f14ec99cf97aff5eb30; From cf24f5a5feeaae34c1a34d1e04f8ac697290427a · fixed in ceb00cb87a22c42d20c39336213db2b843ca9e34; From cf24f5a5feeaae34c1a34d1e04f8ac697290427a · fixed in 5e94d74e4f3baebaa083288f33b4be7ce0a34982; From cf24f5a5feeaae34c1a34d1e04f8ac697290427a · fixed in bd44a6dcd4248883de90f5dad53ae80066e27096
- Linux Linux
6.6
- KernelLinux
From 6.6.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8