In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new<\/p>\n
Commit 9a05475cebdd (“ipvs: avoid kmem_cache_zalloc in
\nip_vs_conn_new”) changed ip_vs_conn_new() to allocate an ip_vs_conn
\nobject with kmem_cache_alloc(). The function then initializes many
\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the
\ntwo struct ip_vs_seq members.<\/p>\n
That leaves init_seq and previous_delta uninitialized. This is normally
\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or
\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync
\nmessage, however, ip_vs_proc_conn() preserves those flags from
\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits
\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with
\nSEQ flags set but with the rest of in_seq\/out_seq still containing stale
\nslab data.<\/p>\n
When a packet for such a connection is later handled by an IPVS
\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use
\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed
\nsync message can therefore make forwarded packets carry stale slab bytes
\nin their TCP seq\/ack numbers, and can also corrupt the forwarded TCP
\nflow.<\/p>\n
Reset both struct ip_vs_seq members completely before publishing the
\nconnection. This matches the existing “reset struct ip_vs_seq” comment
\nand keeps the sequence-adjustment gates inactive unless valid sequence
\ndata is installed later.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new<\/p>\n
Commit 9a05475cebdd (“ipvs: avoid kmem_cache_zalloc in
\nip_vs_conn_new”) chang<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6732","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6732","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}