In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
veth: convert frag_list skbs before running XDP<\/p>\n
A frag_list skb can reach veth with data_len set but nr_frags zero.
\nveth_convert_skb_to_xdp_buff() only converts skbs that are shared,
\nlocked, have frags[], or do not have enough headroom. It later uses
\nskb_is_nonlinear() to decide whether to set XDP_FLAGS_HAS_FRAGS and
\nxdp_frags_size.<\/p>\n
That exposes frag_list data to XDP as if it were stored in frags[], but
\nfrags[] is empty. AF_XDP copy mode can then trust the bogus XDP fragment
\nmetadata, walk an empty fragment entry, and crash in memcpy() from
\n__xsk_rcv().<\/p>\n
Route non-linear skbs through skb_pp_cow_data() before exposing them to
\nXDP, and only advertise XDP frags when the resulting skb has frags[].
\nskb_copy_bits() already handles frag_list input, and skb_pp_cow_data()
\nbuilds frags[] output with skb_add_rx_frag(), which is the
\nrepresentation XDP multi-buffer expects.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
veth: convert frag_list skbs before running XDP<\/p>\n
A frag_list skb can reach veth with data_len set but nr_frags zero.
\nveth_convert_s<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7466","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}