In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: fix corruption of urgent data on multi-segment retransmit<\/p>\n
On the normal xmit path, while in urgent mode we refuse to build a
\nmulti-segment TSO packet, so every segment gets its own urg_ptr:<\/p>\n
\t\/* tcp_write_xmit() *\/
\n\tlimit = mss_now;
\n\tif (tso_segs > 1 && !tcp_urg_mode(tp))
\n\t\tlimit = tcp_mss_split_point(…);<\/p>\n
The retransmit path has no such guard. __tcp_retransmit_skb() builds a
\nsegs > 1 skb and hands it to the GSO layer, which only advances th->seq
\nper segment and copies urg_ptr verbatim:<\/p>\n
\t\/* __tcp_retransmit_skb() *\/
\n\tlen = cur_mss * segs;\t\t\/* segs > 1, no urg_mode check *\/
\n\t…
\n\t\/* tcp_gso_segment(): bumps seq only, urg_ptr is copied *\/<\/p>\n
urg_ptr is an offset from the segment’s own seq, so a copied value points
\nat a different place on each segment. The receiver rebuilds the absolute
\nurgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead
\nof the one OOB byte:<\/p>\n
\tseg1 seq 1 urg_ptr 5001 -> urgent @ 5001 (ok)
\n\tseg2 seq 1001 urg_ptr 5001 -> urgent @ 6001 (wrong, +MSS)
\n\tseg3 seq 2001 urg_ptr 5001 -> urgent @ 7001 (wrong, +2*MSS)<\/p>\n
The real OOB byte is never pointed at, so the receiver stops splicing it
\nout and delivers it as normal in-band data, corrupting the stream.<\/p>\n
Guard the retransmit length like the xmit path: keep segs = 1 while in
\nurgent mode.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: fix corruption of urgent data on multi-segment retransmit<\/p>\n
On the normal xmit path, while in urgent mode we refuse to build a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25463","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}