In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xdp: reject clones that overrun skb_shared_info tailroom<\/p>\n
xdpf_clone() clones broadcast copies into a single page and sets
\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that
\npage like a normal XDP frame and expects the usual skb_shared_info
\ntailroom at the end of the buffer.<\/p>\n
The current check only rejects frames whose linear xdp_frame header,
\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a
\nlarger allocation can still satisfy that check while extending into the
\nclone’s required shared-info area. When such a clone is converted back
\ninto an skb, build_skb_around() places skb_shared_info over live packet
\nbytes and later writes can corrupt XDP return metadata.<\/p>\n
Reject clones unless their linear area fits inside
\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already
\nenforced by the XDP-to-skb conversion path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xdp: reject clones that overrun skb_shared_info tailroom<\/p>\n
xdpf_clone() clones broadcast copies into a single page and sets
\nframe_sz<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11222","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}