In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag<\/p>\n
nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6
\nfragment header and then unconditionally advances skb->mac_header:<\/p>\n
\tskb->mac_header += sizeof(struct frag_hdr);<\/p>\n
On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header
\nyet, so skb->mac_header is still the “not set” sentinel (u16)~0U. Adding
\nsizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7),
\nafter which skb_mac_header_was_set() wrongly reports a MAC header is
\npresent and skb_mac_header() points into the headroom.<\/p>\n
The reassembler has done this unconditional add since it was introduced;
\nit was harmless while mac_header was a bare pointer, but wrong once
\nmac_header became a u16 offset whose unset state is the ~0U sentinel
\ntested by skb_mac_header_was_set(). The sibling net\/ipv6\/reassembly.c
\ndoes the same relocation and does guard the adjustment; mirror the
\nguard here.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag<\/p>\n
nf_ct_frag6_reasm() slides the packet head forward to<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6871","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}