In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: iptfs: fix runt reassembly panic from short inner tot_len<\/p>\n
When the start of an inner packet is split across two outer packets
\nsuch that fewer than 4 bytes land at the end of the first one,
\n__input_process_payload() saves those bytes as a runt and skips the
\niplen\/iphlen validation performed for in-place packets. When the
\ncontinuation packet arrives, iptfs_reassem_cont() only requires the
\ndeclared inner length to be >= sizeof(ra_runt) (6) before allocating
\nthe reassembly skb with that attacker-controlled length.<\/p>\n
However, __iptfs_iphlen() always returns the fixed minimum IP header
\nsize (20 for IPv4, 40 for IPv6), so for an inner IPv4 tot_len in
\n[6, 19] the header-completion copy writes past the declared packet
\nlength, and the subsequent “ipremain -= copylen” underflows to ~4GB,
\nleaving the payload copy length bounded only by blkoff (up to 64KB).
\nAt runtime the skb_put() tailroom check turns this into
\nskb_over_panic(), i.e. an unprivileged kernel panic (DoS), reachable
\nlocally via userns+netns IPTFS SAs and remotely against IPTFS VPN
\ngateways when the decrypted outer skb is linear (e.g. AF_PACKET taps,
\ntun\/tap delivery).<\/p>\n
Align the runt path with the normal path by requiring the declared
\ninner length to cover at least the IP header size. This also subsumes
\nthe previous >= sizeof(ra_runt) check, since the minimum IP header
\nis always larger than the runt buffer.<\/p>\n
This issue was found by the autokbug dynamic kernel fuzzer at
\nTencent Yunding Lab.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: iptfs: fix runt reassembly panic from short inner tot_len<\/p>\n
When the start of an inner packet is split across two outer packet<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33440","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}