In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()<\/p>\n
gtp1u_send_echo_resp() ignores skb_pull_data()’s return value. Its
\ncaller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr +
\ngtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For
\na 16-19 byte echo request the pull fails and returns NULL without
\nadvancing skb->data; execution continues, and the following skb_push()
\nplus the IP header pushed by iptunnel_xmit() move skb->data below
\nskb->head, tripping skb_under_panic().<\/p>\n
Fix it by dropping the packet when skb_pull_data() fails.<\/p>\n
skbuff: skb_under_panic: …
\n kernel BUG at net\/core\/skbuff.c:214!
\n Call Trace:
\n skb_push (net\/core\/skbuff.c:2648)
\n iptunnel_xmit (net\/ipv4\/ip_tunnel_core.c:82)
\n gtp_encap_recv (drivers\/net\/gtp.c:701 drivers\/net\/gtp.c:808 drivers\/net\/gtp.c:920)
\n udp_queue_rcv_one_skb (net\/ipv4\/udp.c:2388)
\n …
\n Kernel panic – not syncing: Fatal exception in interrupt<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()<\/p>\n
gtp1u_send_echo_resp() ignores skb_pull_data()’s return value. Its
\ncal<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4653","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}