In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
macsec: don’t read an unset MAC header in macsec_encrypt()<\/p>\n
macsec_encrypt() reads the Ethernet header via eth_hdr(skb)
\n(skb->head + skb->mac_header) to memmove() the 12 source\/destination MAC
\nbytes forward and make room for the SecTAG.<\/p>\n
On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb
\nreaches the macsec ndo_start_xmit() with the MAC header unset, so
\neth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of
\nbounds: a 12-byte heap over-read that is also emitted on the wire as the
\nframe’s outer source\/destination MAC. KASAN reports a slab-out-of-bounds
\nread in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET
\nbuild flags it as an unset mac header in skb_mac_header().<\/p>\n
On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added
\nby commit 96cc4b69581d (“macvlan: do not assume mac_header is set in
\nmacvlan_broadcast()”) for exactly this purpose.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
macsec: don’t read an unset MAC header in macsec_encrypt()<\/p>\n
macsec_encrypt() reads the Ethernet header via eth_hdr(skb)
\n(skb->head <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6731","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}