In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header<\/p>\n
dev_validate_header() reads dev->hard_header_len directly when
\nzero-padding short link layer headers for CAP_SYS_RAWIO holders:<\/p>\n
if (capable(CAP_SYS_RAWIO)) {
\n memset(ll_header + len, 0, dev->hard_header_len – len);
\n return true;
\n }<\/p>\n
Packet send paths call dev_validate_header() on skbs whose headroom was
\nallocated from an earlier hard_header_len read. If the device is
\nreconfigured so that dev->hard_header_len increases before validation,
\nthe memset writes past the reserved buffer, an out-of-bounds write.<\/p>\n
This out-of-bounds write is masked in some SOCK_RAW paths today because
\nthe same concurrent increase can first make skb_push() exceed the
\nreserved headroom and trigger skb_under_panic(). Remove the zero-padding
\nbranch before making those hard_header_len reads consistent, so the
\nsnapshot fixes do not turn a loud panic into a silent overwrite.<\/p>\n
This path is only reached for variable length L2 protocols, where
\nlen = min_header_len. No remaining in-tree
\nvariable length L2 protocol implements header_ops->validate, and the
\nCAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no
\nreal value beyond allowing testing of intentionally malformed input.<\/p>\n
Drop the CAP_SYS_RAWIO branch. The remaining reads of
\ndev->hard_header_len in dev_validate_header() are comparisons only and
\nhave no memory safety impact.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header<\/p>\n
dev_validate_header() reads dev->hard_header_len directly when
\nzero-<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-3383","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/3383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}