In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: mpls: clear inner_protocol when the last label is popped<\/p>\n
skb_mpls_push() records the pre-encapsulation network header once, gated
\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it
\noutlives the encapsulation it describes.<\/p>\n
Open vSwitch can then re-push MPLS onto a packet whose
\ninner_network_header still points at the older, deeper offset: push a
\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives
\nkey->eth.type and resets network_header, but leaves inner_*), then push
\nagain. ovs_fragment() trusts the record:<\/p>\n
\tskb->network_header = skb->inner_network_header;<\/p>\n
so skb_network_offset() goes negative. The bound check is signed:<\/p>\n
\tif (skb_network_offset(skb) > MAX_L2_LEN)<\/p>\n
a negative offset passes it, and prepare_frag() widens the value:<\/p>\n
\tunsigned int hlen = skb_network_offset(skb);
\n\tmemcpy(&data->l2_data, skb->data, hlen);<\/p>\n
which is a ~4GiB memcpy out of a 30-byte per-CPU buffer.<\/p>\n
Reproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):<\/p>\n
BUG: unable to handle page fault for address: ffffe8ffffc16000
\n #PF: supervisor write access in kernel mode
\n Oops: 0002 [#1] SMP KASAN NOPTI
\n RIP: 0010:memcpy+0x8\/0x20
\n RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000
\n prepare_frag+0x3df\/0x4e0
\n ovs_fragment+0x589\/0x7e0
\n do_output+0x4ce\/0x5e0
\n do_execute_actions+0x55d2\/0x7b30
\n ovs_execute_actions+0xea\/0x450<\/p>\n
Same root-cause shape as commit 975b5b067f52 (“ipv6: sr: restore network
\nheader before routing and forwarding”): a stale network header offset
\nreaching a consumer that widens it. Here it originates in the MPLS
\npush\/pop path.<\/p>\n
Clear inner_protocol once the packet is no longer MPLS, so a later push
\nre-records the current header. net\/sched\/act_mpls.c is the only other
\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and
\nrestores inner_protocol around fragmentation in the same way OVS does.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: mpls: clear inner_protocol when the last label is popped<\/p>\n
skb_mpls_push() records the pre-encapsulation network header once, g<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29044","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29044","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29044"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29044"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29044"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}