Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 82f9028e83944a9eee5229cbc6fee9be1de8a62d before f9451d0fd5ba635dcabb49bfe456a6db734a8986; affected 946dec89c41726b94d31147ec528b96af0be1b5a before 38e94d63e29f4a5c6eae87ee2c02101aaa321502; affected 82fe78065450d2d07f36a22e2b6b44955cf5ca5b before fbeb65154583879d556ea94cb2f15888e9470f3d; affected 0c716703965ffc5ef4311b65cb5d84a703784717 before c7fc9adf4e006155f7f2aeda052fbcde25cdcc49; affected 0c716703965ffc5ef4311b65cb5d84a703784717 before e6b8463b7d791f3886d7584259d6e9f06a69f12e; affected 0c716703965ffc5ef4311b65cb5d84a703784717 before 9e5ad06ea826322ce8c58b4a68442a96f600c3c4; affected 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2; affected 6.1.159 before 6.1.178; affected 6.6.117 before 6.6.145; affected 6.12.58 before 6.12.97; affected 6.17.8 before 6.18 |
| Linux / Linux | affected 6.18; unaffected 0 before 6.18; unaffected 6.1.178 through 6.1.*; unaffected 6.6.145 through 6.6.*; unaffected 6.12.97 through 6.12.*; unaffected 6.18.40 through 6.18.*; unaffected 7.1.5 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986
- https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502
- https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d
- https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49
- https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e
- https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.