CVE-2015-5156: Buffer Overflow

The virtnetprobe function in drivers/net/virtionet.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.

— Launchpad

When a guests KVM network devices is in a bridge configuration the kernel can create a situation in which packets are fragmented in an unexpected fashion. The GRO functionality can create a situation in which multiple SKB's are chained together in a single packets fraglist (by design).

The virtio module declares support for NETIFFFRAGLIST and assumes that there are at most MAXSKBFRAGS + 2 fragments which isn't always true with a fraglist, when GRO is enabled on the incoming driver it can create more fragments than expected.

A longer than expected fragment list in the socket buffer will make the call to skbtosgvec overflow the sg array, leading to memory corruption. It is unlikely that an attacker can use this as controlled memory corruption to execute arbitrary code.

Upstream patch: http://marc.info/?l=linux-netdev&m=143868216724068&w=2

References: http://www.openwall.com/lists/oss-security/2015/08/06/1

Acknowledgements:

This issue was discovered by Jason Wang of Red Hat.

— Red Hat