In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: stmmac: fix TSO header length truncation<\/p>\n
stmmac_tso_xmit() stores the protocol header length returned by
\nstmmac_tso_header_size() in a u8. stmmac_tso_valid_packet() admits
\nheaders up to 1023 bytes, so a header longer than 255 bytes wraps modulo
\n256 (486 becomes 230, 256 becomes 0).<\/p>\n
A TCP over IPv6 socket carrying a few hundred bytes of sticky
\ndestination\/hop-by-hop options makes skb_tcp_all_headers() exceed 255
\nwhile staying below the 1023-byte limit, so such an skb reaches
\nstmmac_tso_xmit().<\/p>\n
Widen proto_hdr_len to unsigned int, which is sufficient since the value
\nis bounded by the hardware limit, and adjust the debug print specifier
\naccordingly.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: stmmac: fix TSO header length truncation<\/p>\n
stmmac_tso_xmit() stores the protocol header length returned by
\nstmmac_tso_header_si<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33357","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33357"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33357"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}