In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
esp: do not unref managed frag pages in esp_ssg_unref()<\/p>\n
esp_ssg_unref() releases the page references held on the source
\nscatterlist after the AEAD operation completes. It calls
\nskb_page_unref() on every frag page for an out-of-place transform
\n(req->src != req->dst), and in the error path of esp_output_tail()
\n(already_unref == true) on the request’s own scatterlist.<\/p>\n
This is wrong when the skb carries managed frags
\n(SKBFL_MANAGED_FRAG_REFS). Managed frags are owned by a zerocopy ubuf
\nand the skb does not hold a per-frag page reference; io_uring SEND_ZC
\nwith a registered buffer attaches the bvec pages this way via
\nio_sg_from_iter(). The rest of the stack honours this invariant:
\nskb_release_data() skips the per-frag unref when SKBFL_MANAGED_FRAG_REFS
\nis set, and skb_zcopy_managed() is the guard used at the other unref
\nsites.<\/p>\n
esp_ssg_unref() is missing that guard, so for a managed-frag skb it
\ndrops a page reference the skb never acquired. This can underflow the
\npage reference count and free a page that is still in use.<\/p>\n
Guard the function with skb_zcopy_managed() so both unref paths are
\nskipped for managed-frag skbs, matching skb_release_data().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
esp: do not unref managed frag pages in esp_ssg_unref()<\/p>\n
esp_ssg_unref() releases the page references held on the source
\nscatterlis<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25962","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}