CVE-2024-49948: net: add more sanity checks to qdisc_pkt_len_init()
In the Linux kernel, the following vulnerability has been resolved:
net: add more sanity checks to qdiscpktleninit()
One path takes care of SKBGSODODGY, assuming skb->len is bigger than hdrlen.
virtionethdrtoskb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.
It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.
- 20 bytes of IPv4 header - 60 bytes TCP header - a small gsosize like 8
virtionethdrtoskb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gsosize.
We need to make detect this case to not underflow qdiscskbcb(skb)->pktlen.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49948?
CVE-2024-49948 has been rated as having a moderate severity level.
How do I fix CVE-2024-49948?
To address CVE-2024-49948, update the Linux kernel to a version that contains the fix.
Which versions of Linux kernel are affected by CVE-2024-49948?
CVE-2024-49948 affects Linux kernel versions between 3.9 and 6.12-rc1.
What does CVE-2024-49948 entail?
CVE-2024-49948 addresses an issue in the Linux kernel related to insufficient sanity checks in the network stack.
Is CVE-2024-49948 a common vulnerability?
CVE-2024-49948 is specific to the Linux kernel and may not be widely applicable outside Linux-based systems.