In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: account for fraggap on the paged allocation path<\/p>\n
In __ip_append_data(), when the paged-allocation branch is taken,
\nalloclen and pagedlen are computed as<\/p>\n
\talloclen = fragheaderlen + transhdrlen;
\n\tpagedlen = datalen – transhdrlen;<\/p>\n
datalen already includes fraggap, but the fraggap bytes carried over
\nfrom the previous skb are copied into the new skb’s linear area at
\noffset transhdrlen by the subsequent skb_copy_and_csum_bits(). The
\nlinear area is therefore undersized by fraggap bytes while pagedlen is
\noverstated by the same amount.<\/p>\n
The non-paged branch sets alloclen to fraglen, which already accounts
\nfor fraggap because datalen does. Bring the paged branch in line by
\nadding fraggap to alloclen and subtracting it from pagedlen.<\/p>\n
After this adjustment, copy no longer collapses to -fraggap on the
\npaged path, so remove the stale comment describing that old arithmetic.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: account for fraggap on the paged allocation path<\/p>\n
In __ip_append_data(), when the paged-allocation branch is taken,
\nalloclen <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14592","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14592"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14592"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}