Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. By sending specially crafted network packets, an attacker can trigger a kernel panic (system crash), leading to a denial of service. This affects systems using specific network offloading features and packet scheduling algorithms.
Technical details
A vulnerability exists in the Linux kernel's qdisc_pkt_len_init() function due to an integer underflow when handling UDP Fragmentation Offload (UFO) packets. Specifically, malicious userspace applications can craft GSO packets where the total length matches the header length, causing gso_segs to be calculated as zero. This leads to an underflow in the packet length calculation, eventually triggering a NULL pointer dereference in the fq_codel packet scheduler. The attack requires local access to send crafted packets via virtio_net or packet sockets. Patches have been released across multiple stable kernel branches to add necessary sanity checks.
Affected products
- Linux Linux Kernel 6.11.0-virtme
Timeline
- 2024-09-24: patched: Initial patch authored by Eric Dumazet
- 2024-10-21: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/1598d70ad9c7d0a4d9d54b82094e9f45908fda6d
- https://git.kernel.org/stable/c/25ab0b87dbd89cecef8a9c60a02bb97832e471d1
- https://git.kernel.org/stable/c/81fd007dcd47c34471766249853e4d4bce8eea4b
- https://git.kernel.org/stable/c/939c88cbdc668dadd8cfa7a35d9066331239041c
- https://git.kernel.org/stable/c/ba26060a29d3ca1bfc737aa79f7125128f35147c
- https://git.kernel.org/stable/c/c20029db28399ecc50e556964eaba75c43b1e2f1
- https://git.kernel.org/stable/c/d6114993e0a89fde84a60a60a8329a571580b174