In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
inet: frags: strip GSO state from fragments before reassembly<\/p>\n
A virtio_net_hdr (tun\/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
\ninet_frag_reasm_prepare()\/inet_frag_reasm_finish() keep the first
\nfragment’s skb as the head of the reassembled datagram, including its
\nshinfo->gso_size\/gso_type\/gso_segs, and chain the remaining fragments
\non frag_list with whatever linear\/paged layout they arrived with.<\/p>\n
After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, …) the
\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and
\nthe next software segmentation point – udp_rcv_segment() on local
\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow
\npath – hands it to skb_segment(). skb_segment()’s frag_list walk
\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to
\na tap by an unprivileged user in its own userns are enough:<\/p>\n
kernel BUG at net\/core\/skbuff.c:4899!
\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2
\n RIP: 0010:skb_segment+0x20ca\/0x48b0
\n Call Trace:<\/p>\n
__udp_gso_segment+0x29a\/0x27d0
\n udp4_ufo_fragment+0x458\/0x6c0
\n inet_gso_segment+0x429\/0x1340
\n skb_mac_gso_segment+0x233\/0x4f0
\n __skb_gso_segment+0x308\/0x660
\n udp_queue_rcv_skb+0x440\/0xad0
\n udp_unicast_rcv_skb+0xc7\/0x2c0
\n udp_rcv+0x16ce\/0x2260
\n ip_protocol_deliver_rcu+0x197\/0x2d0
\n ip_local_deliver+0x430\/0x690
\n ip_rcv+0x16f\/0x1f0
\n __netif_receive_skb_one_core+0x15e\/0x1c0
\n __netif_receive_skb+0x1e\/0x110
\n netif_receive_skb+0xf6\/0x5c0
\n tun_rx_batched.isra.0+0x3ab\/0x790
\n tun_get_user+0x17c3\/0x3550
\n tun_chr_write_iter+0xba\/0x1b0
\n vfs_write+0x646\/0x1130<\/p>\n
Kernel panic – not syncing: Fatal exception in interrupt<\/p>\n
This runs with BH disabled, so it is a panic rather than an oops. The
\nsame is reachable with CAP_NET_RAW in a netns where a defrag point
\nprecedes a GSO point, and from a guest whose VMM forwards
\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by
\ncommit 3dcbdb134f32 (“net: gso: Fix skb_segment splat when splitting
\ngso_size mangled skb having linear-headed frag_list”) and by
\ncommit 9e4b7a99a03a (“net: gso: fix panic on frag_list with mixed head
\nalloc types”) do not cover it: page-backed heads skip them, and kmalloc
\nheads skip them when gso_size == skb_headlen(head), which the sender
\ncontrols.<\/p>\n
An skb entering a frag queue is an IP fragment by definition and
\ncannot legitimately carry GSO state: GRO does not merge fragments and
\nthe stack segments before it fragments, so only untrusted sources are
\naffected. This has been reachable since
\ncommit f43798c27684 (“tun: Allow GSO using virtio_net_hdr”), the first
\npath that let userspace attach GSO metadata to an IP fragment. Reset
\nthe GSO fields of every fragment as it is queued, in
\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and
\n6lowpan reassembly share; then neither the head nor the frag_list
\nmembers of the reassembled skb carry them (the members matter too:
\nthe ip_do_fragment()\/ip6_fragment() fast paths send them out as they
\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted
\non receive and resolved by skb_checksum_help() in
\nip_do_fragment()\/ip6_fragment() on forward.<\/p>\n
Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer
\nabove, two further IPv4 frag_list geometries that reach
\nBUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6
\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched
\nkernel; with this patch all four datagrams are delivered intact and
\nnothing is logged.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
inet: frags: strip GSO state from fragments before reassembly<\/p>\n
A virtio_net_hdr (tun\/tap, or AF_PACKET with PACKET_VNET_HDR) can ma<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12290","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}