In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_skbmod: fix length calculations and avoid invalid header warnings<\/p>\n
syzbot reported a warning in skb_network_header_len() triggered
\nby tcf_skbmod_act():<\/p>\n
!skb_transport_header_was_set(skb)
\n WARNING: CPU: 0 PID: 14949 at include\/linux\/skbuff.h:3243 skb_network_header_len include\/linux\/skbuff.h:3243 [inline]
\n WARNING: CPU: 0 PID: 14949 at net\/sched\/act_skbmod.c:55 tcf_skbmod_act+0xfe8\/0x1810 net\/sched\/act_skbmod.c:55<\/p>\n
There are a few issues in tcf_skbmod_act():<\/p>\n
1. Calling skb_network_header_len() assumes skb->transport_header is set,
\n which is not guaranteed when tcf_skbmod_act() runs at TC ingress.
\n2. Unconditionally calling skb_mac_header_len() at the beginning of
\n tcf_skbmod_act() triggers a warning on L3 devices (e.g. TUN) where the
\n MAC header is unset, evaluating to an underflowed garbage length.
\n3. On TC ingress, skb->data points to the network header. Adding the MAC
\n header length to the IP header length causes skb_ensure_writable() to
\n request more bytes than the actual IP packet length, dropping valid
\n short packets (e.g. 28-byte UDP\/IPv4 packets).<\/p>\n
Fix these by:
\n– Using skb_network_offset(skb) + sizeof(struct iphdr\/ipv6hdr) for
\n SKBMOD_F_ECN so that the required length is correctly calculated on
\n both ingress (offset == 0) and egress (offset == mac_len).
\n– Setting max_edit_len to ETH_HLEN for Ethernet header modifications
\n after validating ARPHRD_ETHER.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_skbmod: fix length calculations and avoid invalid header warnings<\/p>\n
syzbot reported a warning in skb_network_header_l<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25487","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}