In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: lan743x: fix RX checksum use-after-free<\/p>\n
lan743x_rx_process_buffer() adds each non-first receive buffer to the
\nhead skb’s frag_list. On the last descriptor, lan743x_rx_trim_skb()
\nlinearizes the head and frees the fragment skb metadata.<\/p>\n
The checksum-success path then writes ip_summed through the local skb
\npointer, which still points to the final fragment. This causes a
\nuse-after-free write when a packet spans more than one receive buffer.<\/p>\n
Set ip_summed on the surviving head skb instead. Multi-buffer receive
\ncan occur after a live MTU increase because existing ring entries keep
\ntheir old buffer size until they are replenished.<\/p>\n
A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer
\npacket produced a one-byte KASAN use-after-free write before this change.
\nThe same test passed after the change. The driver object also builds
\nwith W=1. This was not tested on physical LAN743x hardware.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: lan743x: fix RX checksum use-after-free<\/p>\n
lan743x_rx_process_buffer() adds each non-first receive buffer to the
\nhead skb’s frag<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33308","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}