In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring<\/p>\n
When an sk_msg scatterlist ring wraps (sg.end < sg.start),
\ntls_push_record() chains the tail portion of the ring to the head
\nusing sg_chain(). An extra entry in the sg array is reserved for
\nthis:<\/p>\n
struct sk_msg_sg {
\n […]
\n \/* The extra two elements:
\n * 1) used for chaining the front and sections when the list becomes
\n * partitioned (e.g. end sg.data[msg_pl->sg.start],
\n MAX_SKB_FRAGS – msg_pl->sg.start + 1,
\n msg_pl->sg.data);<\/p>\n
This places the chain pointer at<\/p>\n
sg_chain(data[start], (MAX_SKB_FRAGS – msg_start + 1) .. =
\n &data[start] + (MAX_SKB_FRAGS – msg_start + 1) – 1 =
\n data[start + (MAX_SKB_FRAGS – start + 1) – 1] =
\n data[MAX_SKB_FRAGS]<\/p>\n
instead of the true last entry. This is likely due to a “race” of
\nthe commit under Fixes landing close to
\ncommit 031097d9e079 (“bpf: sk_msg, zap ingress queue on psock down”)<\/p>\n
Convert to ARRAY_SIZE and drop the data[start] \/ – start (as suggested
\nby Sabrina).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring<\/p>\n
When an sk_msg scatterlist ring wraps (sg.end < sg.start)<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15036","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15036","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15036"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15036"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15036"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}