In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: gro: fix double aggregation of flush-marked skbs<\/p>\n
Commit 0ab03f353d36 (“net-gro: Fix GRO flush when receiving a GSO
\npacket.”) added a flush check to skb_gro_receive(), but
\nskb_gro_receive_list() lacks the same validation.<\/p>\n
As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be
\nre-aggregated.<\/p>\n
This allows already-GRO’d packets with existing frag_list to be
\nre-aggregated into a new GRO session, corrupting the frag_list chain
\nstructure. When skb_segment() attempts to unpack these malformed packets,
\nit encounters invalid state and triggers a kernel panic.<\/p>\n
Scenario (Tethering\/Device forwarding):
\n 1. Driver: Generated aggregated packet P1 via LRO with frag_list
\n 2. Dev A: Receives aggregated fraglist packet and flush flag set
\n 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
\n 4. Missing flush check allows re-aggregation despite flush flag
\n 5. Frag_list chain becomes corrupted (loops or dangling refs)
\n 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list<\/p>\n
Root cause in skb_segment():
\n The check at line ~4891:
\n if (hsize = nfrags && skb_headlen(list_skb) &&
\n (skb_headlen(list_skb) == len || sg)) {<\/p>\n
When frag_list is corrupted by double aggregation, when list_skb is
\n a NULL pointer from skb->next, skb_headlen(list_skb) dereference
\n NULL\/corrupted pointers occurs.<\/p>\n
Call Trace:
\n skb_headlen(NULL skb)
\n skb_segment
\n tcp_gso_segment
\n tcp4_gso_segment
\n inet_gso_segment
\n skb_mac_gso_segment
\n __skb_gso_segment
\n skb_gso_segment
\n validate_xmit_skb
\n validate_xmit_skb_list
\n sch_direct_xmit
\n qdisc_restart
\n __qdisc_run
\n qdisc_run
\n net_tx_action<\/p>\n
Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in
\nskb_gro_receive_list(), matching the defensive programming pattern of
\nskb_gro_receive().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: gro: fix double aggregation of flush-marked skbs<\/p>\n
Commit 0ab03f353d36 (“net-gro: Fix GRO flush when receiving a GSO
\npacket.”) <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5344","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}