CVE-2024-50258: net: fix crash when config small gso_max_size/gso_ipv4_max_size
In the Linux kernel, the following vulnerability has been resolved:
net: fix crash when config small gsomaxsize/gsoipv4maxsize
Config a small gsomaxsize/gsoipv4maxsize will lead to an underflow in skdstgsomaxsize(), which may trigger a BUGON crash, because sk->skgsomaxsize would be much bigger than device limits. Call Trace: tcpwritexmit tsosegs = tcpinittsosegs(skb, mssnow); tcpsetskbtsosegs tcpskbpcountset // skb->len = 524288, mssnow = 8 // u16 tsosegs = 524288/8 = 65535 -> 0 tsosegs = DIVROUNDUP(skb->len, mssnow) BUGON(!tsosegs) Add check for the minimum value of gsomaxsize and gsoipv4maxsize.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Configure gso_max_size and gso_ipv4_max_size to no smaller than their minimum supported values to prevent the underflow in sk_dst_gso_max_size().
Linux kernel networking gso_max_size and gso_ipv4_max_size = minimum value
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50258?
CVE-2024-50258 is considered a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-50258?
To fix CVE-2024-50258, upgrade your Linux kernel to a version that includes the patch, such as versions 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
Which Linux kernel versions are affected by CVE-2024-50258?
CVE-2024-50258 affects Linux kernel versions between 4.16 and 6.6.60, as well as certain release candidates up to 6.12-rc5.
What happens if CVE-2024-50258 is exploited?
Exploitation of CVE-2024-50258 can lead to an underflow that may trigger a BUG_ON crash in the Linux kernel.
Is CVE-2024-50258 fixed in Linux kernel versions 6.12 and above?
Yes, CVE-2024-50258 has been resolved in releases beyond version 6.12, ensuring that the vulnerability no longer exists.