In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: ioam: refresh hdr pointer before ioam6_event()<\/p>\n
Reported by Sashiko:<\/p>\n
In ipv6_hop_ioam(), the hdr pointer is initialized to point into the
\nskb’s linear data buffer. Later, the code calls skb_ensure_writable(),
\nwhich might reallocate the buffer:<\/p>\n
\tif (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len))
\n\t\tgoto drop;<\/p>\n
\t\/* Trace pointer may have changed *\/
\n\ttrace = (struct ioam6_trace_hdr *)(skb_network_header(skb)
\n\t\t\t\t\t + optoff + sizeof(*hdr));<\/p>\n
\tioam6_fill_trace_data(skb, ns, trace, true);<\/p>\n
\tioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev),
\n\t\t GFP_ATOMIC, (void *)trace, hdr->opt_len – 2);<\/p>\n
If the skb is cloned or lacks sufficient linear headroom,
\nskb_ensure_writable() will invoke pskb_expand_head(), which reallocates
\nthe skb’s data buffer and frees the old one, invalidating pointers to
\nit. While the code recalculates the trace pointer immediately after the
\ncall to skb_ensure_writable(), it fails to recalculate the hdr pointer.<\/p>\n
This patch fixes the above by recalculating the hdr pointer before
\npassing hdr->opt_len to ioam6_event(), so that we avoid any UaF.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipv6: ioam: refresh hdr pointer before ioam6_event()<\/p>\n
Reported by Sashiko:<\/p>\n
In ipv6_hop_ioam(), the hdr pointer is initialized to p<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15094","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15094"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}