In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: thunderbolt: Fix frags[] overflow by bounding frame_count<\/p>\n
tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The
\nfirst frame goes into the skb linear area and every further frame is added as
\na page fragment.<\/p>\n
\tskb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
\n\t\t\tpage, hdr_size, frame_size,
\n\t\t\tTBNET_RX_PAGE_SIZE – hdr_size);<\/p>\n
A packet of frame_count frames therefore ends up with frame_count – 1
\nfragments. tbnet_check_frame() only bounds the peer supplied frame_count to
\nTBNET_RING_SIZE \/ 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A
\npeer that sends a packet of 19 or more small frames pushes nr_frags past
\nMAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and
\ncorrupts memory after the shared info.<\/p>\n
Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never
\nproduce more fragments than frags[] can hold. This matches the recent skb
\nfrags overflow fixes in other receive paths, for example f0813bcd2d9d (“net:
\nwwan: t7xx: fix potential skb->frags overflow in RX path”) and 600dc40554dc
\n(“net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: thunderbolt: Fix frags[] overflow by bounding frame_count<\/p>\n
tbnet_poll() assembles a multi-frame ThunderboltIP packet into one <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6809","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}