In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: dsa: tag_brcm: legacy FCS: request needed tailroom<\/p>\n
The legacy FCS tagger calculates the CRC over skb->len bytes starting at
\nskb->data. When a nonlinear skb reaches the tagger, this reads past the
\nlinear head into unrelated slab memory.<\/p>\n
The tagger appends an Ethernet FCS but does not declare that tailroom. As a
\nresult, DSA leaves NETIF_F_SG and NETIF_F_FRAGLIST enabled on the user
\nport, and nonlinear skbs can reach the CRC calculation.<\/p>\n
Declare the required tailroom. DSA will then clear those features and the
\nnetworking core will linearize skbs before the tagger runs.<\/p>\n
A KASAN-enabled dsa_loop test using this tagger reports:<\/p>\n
BUG: KASAN: slab-out-of-bounds in crc32_le
\n Read of size 1 at addr ffff8880397086c0 by task exp\/135<\/p>\n
Call Trace:
\n crc32_le (lib\/crc\/crc32-main.c:38)
\n brcm_leg_fcs_tag_xmit (net\/dsa\/tag_brcm.c:343)
\n dsa_user_xmit (net\/dsa\/user.c:942)
\n dev_hard_start_xmit (net\/core\/dev.c:3937)
\n __dev_queue_xmit (net\/core\/dev.c:4926)
\n packet_sendmsg (net\/packet\/af_packet.c:3110)
\n __sys_sendto (net\/socket.c:2281)<\/p>\n
The buggy address belongs to the object at ffff888039708400
\n which belongs to the cache skbuff_small_head of size 704
\n The buggy address is located 0 bytes to the right of
\n allocated 704-byte region [ffff888039708400, ffff8880397086c0)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: dsa: tag_brcm: legacy FCS: request needed tailroom<\/p>\n
The legacy FCS tagger calculates the CRC over skb->len bytes starting at
\ns<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29046","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}