In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: iptunnel: fix stale transport header during tunnel decapsulation<\/p>\n
Syzbot reported a crash in qdisc_pkt_len_segs_init() caused by a stale
\ntransport_header offset after tunnel decapsulation.<\/p>\n
BUG: unable to handle page fault for address: ffffed102091a42e
\nOops: Oops: 0000 [#1] SMP KASAN NOPTI
\nCPU: 0 UID: 0 PID: 340 Comm: qdisc_uaf_repro Not tainted 7.2.0-rc4-00061-g248951ddc14d #256 PREEMPT(full)
\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\nRIP: 0010:__asan_load2<\/p>\n
qdisc_pkt_len_segs_init (net\/core\/dev.c:4145)
\n__dev_queue_xmit (net\/core\/dev.c:4787)
\nbr_dev_queue_push_xmit (net\/bridge\/br_forward.c:53)
\nbr_handle_frame_finish (net\/bridge\/br_input.c:229)
\nbr_handle_frame (net\/bridge\/br_input.c:315)
\n__netif_receive_skb_core.constprop.0 (net\/core\/dev.c:6099)
\n__netif_receive_skb_list_core (net\/core\/dev.c:6287)
\nnetif_receive_skb_list_internal (net\/core\/dev.c:6445)
\nnapi_complete_done (net\/core\/dev.c:6813)
\ngro_cell_poll (net\/core\/gro_cells.c:74)
\n__napi_poll (net\/core\/dev.c:7735)
\nnet_rx_action (net\/core\/dev.c:7798 net\/core\/dev.c:7955)
\nhandle_softirqs (kernel\/softirq.c:622)
\ndo_softirq (kernel\/softirq.c:523 kernel\/softirq.c:510 )
\n__local_bh_enable_ip (kernel\/softirq.c:450)
\ntun_get_user (drivers\/net\/tun.c:1986 (discriminator 1))
\ntun_chr_write_iter (drivers\/net\/tun.c:2032)<\/p>\n
The issue is completely latent until qdisc read transport header in
\ncommit 7fb4c1967011 (“net: pull headers in qdisc_pkt_len_segs_init()”).
\nThe crash requires four conditions to line up:<\/p>\n
1. The incoming packet is encapsulated and carries GSO metadata. The outer
\n transport header offset is stored in skb->transport_header while the
\n packet is still in the outer tunnel context.
\n2. The tunnel receiver strips the outer headers. skb->data is advanced to
\n the inner frame, but skb->transport_header is left pointing to the
\n now-removed outer L4 header, so it becomes a negative offset relative to
\n the new data.
\n3. The inner frame is not delivered to the local IP stack. Instead, it
\n is forwarded at L2 by a bridge or HSR, so ip_rcv_core() never runs and
\n the transport header is not reset to the inner L4 offset.
\n4. The forwarding path calls __dev_queue_xmit(), which enters
\n qdisc_pkt_len_segs_init(). That function computes the GSO header length
\n from skb_transport_offset(skb). Because the offset is negative, the
\n unsigned cast overflows and pskb_may_pull(skb, hdr_len +
\n sizeof(struct tcphdr)) reads past the end of the skb, triggering a
\n KASAN fault or page fault.<\/p>\n
The issue specifically requires GSO packets (shinfo->gso_size != 0), which
\nare processed\/aggregated through gro_cells. Fix this by clearing
\ntransport_header to the ~0U sentinel in gro_cell for all tunnnel driver.
\nGTP does not support GRO\/GSO, drop the evil GSO packets in GTP directly.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: iptunnel: fix stale transport header during tunnel decapsulation<\/p>\n
Syzbot reported a crash in qdisc_pkt_len_segs_init() caused <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39072","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}