In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: prevent collapsing skbs across boundary in rtx queue<\/p>\n
tcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on
\ntcp_write_queue_tail(sk) to prevent skbs queued after a switch to
\ndevice encryption from being collapsed into earlier skbs.<\/p>\n
The fence is a no-op if all earlier data has already been transmitted
\nwhen the switch happens: sk->sk_write_queue is empty. The not yet
\nacknowledged earlier skbs wait in sk->tcp_rtx_queue with eor 0.<\/p>\n
On a subsequent retransmit or SACK shift, tcp_retrans_try_collapse() or
\ntcp_shift_skb_data() can then merge an skb queued after the switch into
\none queued before it.<\/p>\n
Both users of the fence are affected:<\/p>\n
– psp: devices only encrypt skbs with skb->decrypted set. The merged skb
\n keeps decrypted = 0 from the earlier skb, so merged data sent after
\n psp_sock_assoc_set_tx() is retransmitted in cleartext.<\/p>\n
– tls device offload: the merged skb straddles the start marker set in
\n tls_set_device_offload(). The software fallback (fill_sg_in() returns
\n -EINVAL) and the mlx5, nfp and funeth drivers cannot handle such an
\n skb and drop it. Every retransmit rebuilds the same skb, so the
\n connection stalls.<\/p>\n
Fix this in two places, for defense in depth:<\/p>\n
1. Fall back to tcp_rtx_queue_tail(sk) in tcp_write_collapse_fence()
\n when tcp_write_queue_tail(sk) is NULL.<\/p>\n
2. Check !skb_cmp_decrypted(to, from) in tcp_skb_can_collapse(), as
\n tcp_skb_can_collapse_rx() does on receive. skb_shift(), which both
\n collapse paths call, already has a DEBUG_NET_WARN_ON_ONCE() for this
\n condition.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: prevent collapsing skbs across boundary in rtx queue<\/p>\n
tcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on
\ntcp_write_qu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41021","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}