Junglewise Threat Intelligence

CVE-2024-49948: Linux Kernel integer underflow in qdisc_pkt_len_init

CVE-2024-49948 · Severity: medium · CVSS 5.5 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to cause a system malfunction. By sending specially crafted network packets, an attacker can trigger an internal calculation error (integer underflow) in the system's traffic scheduling logic. This can lead to a denial-of-service condition, potentially crashing the system or disrupting network operations.

Technical details

An integer underflow vulnerability exists in the Linux kernel's 'net' subsystem within the qdisc_pkt_len_init() function. The issue arises because virtio_net_hdr_to_skb() does not fully dissect TCP headers, only ensuring a minimum length of 20 bytes. A local attacker can provide a malicious Generic Segmentation Offload (GSO) packet (e.g., 80 bytes total with a 60-byte TCP header and small gso_size) that bypasses existing checks. This causes the packet length calculation to assume a larger header than the total packet length, leading to an underflow of qdisc_skb_cb(skb)->pkt_len. The vulnerability has been addressed by adding additional sanity checks to validate the payload length before performing the division for segment calculation.

Affected products

  • Linux Linux Kernel 3.9 to 4.19.323, 4.20 to 5.4.285, 5.5 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3

Timeline

  • 2024-09-24: patched: Initial patch authored by Eric Dumazet
  • 2024-10-21: disclosed: CVE published to NVD

References

Related threats