ipv4: validate checksum_start before completing checksum

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.

Affected versions

• Linux Linux

  From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in a464d950f31c89565cbaae038cc60db04fe01956; From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in 0fab003ef4698e0628060a45a48f14b43ba2a40a; From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in 94524b7b32691de2e2ce162c04d6cbc9106e5cbf; From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in a65f69e0f38ffbed1b128029e09097436416dc8b; From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in 32a8b0adaa18e52aaa0b246b5ffe683075354dbb; From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in f3e835af6226f1dd12160cbd696081e9b6155de0; From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in c3e33464746166264334641dc850a36eef7e6326; From f43798c27684ab925adde7d8acc34c78c6e50df8 · fixed in 6785011f8b16abf40b1e9d8b2e332232b3e68822

• Linux Linux

  2.6.27

• KernelLinux

  From 2.6.27 · fixed in 5.10.272; From 5.11.0 · fixed in 5.15.223; From 5.16.0 · fixed in 6.1.190; From 6.2.0 · fixed in 6.6.159; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.11

References 10