In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: synproxy: refresh tcphdr after skb_ensure_writable<\/p>\n
synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
\nand then patches the TCP checksum via inet_proto_csum_replace4() on
\nthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and
\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
\nbefore calling in, so it may either alias skb->head directly or
\npoint at the caller’s on-stack _tcph buffer.<\/p>\n
Between obtaining the pointer and using it, the function calls
\nskb_ensure_writable(skb, optend), which on a cloned or non-linear
\nskb invokes pskb_expand_head() and frees the old skb->head. After
\nthat point the cached th is stale:<\/p>\n
caller (ipv[46]_synproxy_hook)
\n th = skb_header_pointer(skb, …, &_tcph)
\n synproxy_tstamp_adjust(skb, protoff, th, …)
\n skb_ensure_writable(skb, optend)
\n pskb_expand_head() \/* kfree(old skb->head) *\/
\n …
\n inet_proto_csum_replace4(&th->check, …)
\n \/* writes into freed head, or
\n into the caller’s stack copy
\n leaving the on-wire checksum
\n stale *\/<\/p>\n
The option bytes are written through skb->data and are fine; only
\nthe checksum update goes through th and so lands in the wrong
\nplace. The result is either a write into freed slab memory or a
\npacket leaving with a checksum that does not match its payload.<\/p>\n
Fix by re-deriving th from skb->data + protoff immediately after
\nskb_ensure_writable() succeeds, so the subsequent checksum update
\ntargets the linear, writable header.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: synproxy: refresh tcphdr after skb_ensure_writable<\/p>\n
synproxy_tstamp_adjust() rewrites the TCP timestamp option in place<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15006","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15006","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15006"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15006"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15006"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}