In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ipv6: Fix UDP length overflow with PMTU discover and big MTU<\/p>\n
This commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP sockets to
\navoid a possible overflow of UDP length that triggers a WARN in
\nudp_set_len_short when setsockopt IPV6_MTU_DISCOVER is set to
\nIPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE, and a large packet is sent over
\na netdev with an unusually large MTU.<\/p>\n
Steps to reproduce (included in the new selftest):<\/p>\n
1. Set device MTU bigger than IP6_MAX_MTU. cork->base.fragsize will be
\n set to that MTU in ip6_setup_cork.
\n2. Set IPV6_MTU_DISCOVER to IPV6_PMTUDISC_PROBE or IPV6_PMTUDISC_DO. It
\n lets maxnonfragsize be set to device MTU (cork->fragsize) in
\n __ip6_append_data, rather than to IP6_MAX_MTU.
\n3. Send 65528 bytes of payload (+8 bytes of UDP header, +40 bytes of
\n IPv6 header). Device MTU allows it (it’s only one byte bigger than
\n IP6_MAX_MTU, and the device MTU is bigger than that).
\n4. The UDP length in the built packet is 65536, which overflows the
\n 16-bit length field and triggers the WARN in udp_set_len_short.<\/p>\n
To avoid breaking sending UDP jumbograms over raw IPv6 sockets, limit
\nthe change to UDP sockets only.<\/p>\n
The original overflow bug with IPv6 and IPV6_PMTUDISC_DO seems to
\npredate git history (verified reproduction on 2.6.21), was fixed later,
\nand then reappeared in commit 427faee167bc (“net: ipv6: introduce
\nip6_dst_mtu_maybe_forward”), which is chosen as the Fixes tag here. The
\noverflow with IPV6_PMTUDISC_PROBE reproduces since its introduction in
\ncommit 628a5c561890 (“[INET]: Add IP(V6)_PMTUDISC_RPOBE”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: ipv6: Fix UDP length overflow with PMTU discover and big MTU<\/p>\n
This commit bounds cork->base.fragsize to IP6_MAX_MTU for UDP so<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29140","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29140","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29140"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29140"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29140"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}