CVE-2024-49979: net: gso: fix tcp fraglist segmentation after pull from frag_list
In the Linux kernel, the following vulnerability has been resolved:
net: gso: fix tcp fraglist segmentation after pull from fraglist
Detect tcp gso fraglist skbs with corrupted geometry (see below) and pass these to skbsegment instead of skbsegmentlist, as the first can segment them correctly.
Valid SKBGSOFRAGLIST skbs - consist of two or more segments - the headskb holds the protocol headers plus first gsosize - one or more fraglist skbs hold exactly one segment - all but the last must be gsosize
Optional datapath hooks such as NAT and BPF (bpfskbpulldata) can modify these skbs, breaking these invariants.
In extreme cases they pull all data into skb linear. For TCP, this causes a NULL ptr deref in tcpv4gsosegmentlistcsum at tcphdr(seg->next).
Detect invalid geometry due to pull, by checking headskb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skbsegment.
Approach and description based on a patch by Willem de Bruijn.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49979?
The severity of CVE-2024-49979 has been determined to be critical due to its impact on network segmentation in the Linux kernel.
How do I fix CVE-2024-49979?
To fix CVE-2024-49979, update your Linux kernel to a version that is not affected, such as versions above 6.10.14 or 6.11.3.
What systems are affected by CVE-2024-49979?
CVE-2024-49979 affects Linux kernel versions from 6.10 to 6.10.14, 6.11 to 6.11.3, and version 6.12-rc1.
What is the nature of CVE-2024-49979 vulnerability?
CVE-2024-49979 is a vulnerability that affects TCP segmentation offload (TSO) handling, particularly related to corrupted geometry in fragment lists.
Is there any workaround for CVE-2024-49979?
There are no officially recommended workarounds for CVE-2024-49979; upgrading to a patched kernel version is the best approach.