In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: raw: reject IP_HDRINCL packets with ihl ihl * 4;
\n err = -EINVAL;
\n if (iphlen > length)
\n goto error_free;<\/p>\n
if (iphlen >= sizeof(*iph)) {
\n \/* fix up saddr, tot_len, id, csum, transport_header *\/
\n }<\/p>\n
It does not, however, reject ihl = sizeof(*iph))” branch is skipped, leaving the
\ncrafted iphdr untouched, but the packet is still handed to
\n__ip_local_out() and onward. Downstream consumers that read
\niph->ihl assume a sane value: net\/ipv4\/ah4.c:ah_output() in
\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4
\nand passes the (signed-int-negative, then cast to size_t)
\nresult to memcpy(), producing an OOB access of length close to
\nSIZE_MAX and a host kernel panic.<\/p>\n
An IPv4 header with ihl < 5 is malformed by definition (RFC 791:
\n"Internet Header Length is the length of the internet header in
\n32 bit words … Note that the minimum value for a correct header
\nis 5."). The kernel should not be willing to inject such a
\npacket into its own output path.<\/p>\n
Reject "iphlen length” check. This matches the principle that locally
\nconstructed packets that re-enter the IP stack must pass the same
\nbasic sanity tests that a foreign packet would be subjected to.<\/p>\n
Once this lands, the “if (iphlen >= sizeof(*iph))” wrapper around
\nthe fixup branch becomes redundant; left in place to keep the
\npatch minimal and backport-friendly. A follow-up can unwrap it.<\/p>\n
Note that commit 86f4c90a1c5c (“ipv4, ipv6: ensure raw socket
\nmessage is big enough to hold an IP header”) ensures the message
\nbuffer is large enough to hold an iphdr, but does not constrain
\nthe self-reported iph->ihl.<\/p>\n
Reachability: the malformed packet source is any caller with
\nCAP_NET_RAW, including an unprivileged process in a user+net
\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH
\ncrash also requires a matching xfrm AH policy on the outgoing
\nroute; a container granted CAP_NET_ADMIN can install that state
\nand policy in its netns. Loopback bypasses xfrm_output, so the
\ntrigger uses a real netdev.<\/p>\n
Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with
\nmemcpy_orig at the crash site. Same shape reproduces inside a
\nrootless Docker container with –cap-add NET_ADMIN on a stock
\ndistro kernel.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv4: raw: reject IP_HDRINCL packets with ihl < 5<\/p>\n
raw_send_hdrinc() validates that the caller-supplied IPv4 header
\nfits within the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15083","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}