In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: reject oversized tx_queue_len at netlink parse time<\/p>\n
rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len
\nwithout going through netif_change_tx_queue_len(), so a device created
\nwith “ip link add … txqueuelen 500000” bypasses the S16_MAX cap and
\nstill triggers the oversized ring allocations in pfifo_fast, tun and
\ntap. The veth peer nest (rtnl_nla_parse_ifinfomsg()) and the
\nRTM_NEWLINK-on-existing-device path reach the same sinks.<\/p>\n
Enforce the cap in ifla_policy instead: IFLA_TXQLEN becomes
\nNLA_POLICY_FULL_RANGE(NLA_U32, &txqlen_range) with
\ntxqlen_range = { .min = 0, .max = S16_MAX }. All netlink consumers
\nparse against this policy – rtnl_setlink(), rtnl_newlink() (create
\nand change), and the veth peer nest – so every netlink path is capped
\nat parse time and rejects the attribute with -ERANGE plus a proper
\n“integer out of range” extack message before any device state is
\nmodified (the RTM_SETLINK half-application wart is gone with it).<\/p>\n
Document the bound in the rt-link.yaml netlink spec.<\/p>\n
Conditions to recreate the bug:
\n– CONFIG_NET_SCHED=y, CONFIG_VETH=y, CONFIG_USER_NS=y, CONFIG_NET_NS=y.
\n– Unprivileged user in a fresh user+net namespace (unshare -Urn):
\n ip link add v0 txqueuelen 500000 type veth peer name v1
\n -> on the fixed kernel this is rejected with -ERANGE (“integer out
\n of range” extack) instead of installing an oversized tx_queue_len
\n that later inflates pfifo_fast\/tun\/tap ring allocations.
\n– ip link set v0 txqueuelen 500000 is likewise rejected at parse time.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: reject oversized tx_queue_len at netlink parse time<\/p>\n
rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len
\nwith<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29176","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}