In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_ife: Only operate on Ethernet frames<\/p>\n
act_ife encapsulates\/decapsulates the original Ethernet header and uses
\nskb->dev->hard_header_len as the length of that header. That is only
\ncorrect for Ethernet devices: on a device where hard_header_len does not
\nmatch the L2 header that was actually pulled (PPP reports PPP_HDRLEN
\nwhile nothing is stripped on ingress), the ingress skb_push()\/skb_pull()
\nuse the wrong length and can hit skb_under_panic when headroom is tight.<\/p>\n
IFE is Ethernet-only by design – it builds an outer ethhdr, rewrites
\nh_source\/h_dest\/h_proto, and calls eth_type_trans() on decode – so
\ninstead of trying to make the offsets work for arbitrary link types,
\nsimply drop packets that do not carry an Ethernet header.<\/p>\n
Checking skb->dev->type alone is not enough. We have to cater for a
\ncorner case where mirred can redirect an skb from a non-Ethernet device
\nto an Ethernet one, and skb->dev then says nothing about the framing the
\nskb actually has: an skb redirected from ppp0 reaches the target’s ingress
\nhook with mac_len 0 and no Ethernet header at all. So at ingress also
\nrequire mac_len to be ETH_HLEN. On egress mac_len is not maintained, so
\nthe device type is all we have; a bogus redirect there yields a malformed
\nframe rather than an out-of-bounds push, and it would be malformed with or
\nwithout IFE.<\/p>\n
That corner case is not theoretical – redirecting from ppp0 into a veth
\nthat has an ife encode action on its ingress hook panics without this
\npatch:<\/p>\n
skbuff: skb_under_panic: len:98 put:14 head:ffff88800e410000
\n data:ffff88800e40fff5 tail:0x57 end:0x640 dev:veth3
\n kernel BUG at net\/core\/skbuff.c:214!
\n Call Trace:
\n skb_push (net\/core\/skbuff.c:224 net\/core\/skbuff.c:2657)
\n tcf_ife_act (net\/sched\/act_ife.c:829 net\/sched\/act_ife.c:874)
\n tc_run (net\/core\/dev.c:4463)
\n netif_receive_skb (net\/core\/dev.c:6463 net\/core\/dev.c:6522)
\n tcf_mirred_to_dev (net\/sched\/act_mirred.c:248 net\/sched\/act_mirred.c:328)
\n tcf_mirred_act (net\/sched\/act_mirred.c:489)
\n tc_run (net\/core\/dev.c:4463)
\n process_backlog (net\/core\/dev.c:6728)<\/p>\n
With Ethernet framing guaranteed, use ETH_HLEN instead of
\nhard_header_len.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_ife: Only operate on Ethernet frames<\/p>\n
act_ife encapsulates\/decapsulates the original Ethernet header and uses
\nskb->d<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25492","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25492","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}