REDHAT-BUG-2541488: High severity DPDK DPDK vulnerability
A flaw was found in DPDK lib/gso. hdrsegmentinit() copies pkthdroffset bytes from the first mbuf segment into a newly allocated header mbuf using rtememcpy without checking that the source first segment is long enough or that the destination mbuf has enough tailroom. pkthdroffset is taken from mbuf l2/l3/l4 (and outer) length fields, which applications commonly populate from packet headers including IP IHL and TCP data offset. A related uint16t subtraction (gsosize - hdroffset) underflows when the header is larger than gsosize. An application that runs software GSO on packets from an untrusted source (for example a guest via vhost, or scatter RX) can therefore read or write past mbuf bounds.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications that run software GSO on packets from untrusted sources are exposed. Examples given include traffic supplied by a guest through vhost and packets received through scatter RX.
What packet data can influence the unsafe operation?
The packet header length fields used to derive pkt_hdr_offset can be application-populated from packet headers. This includes IP IHL and the TCP data offset, as well as l2, l3, l4, and outer length fields in the mbuf.
What happens when the computed header size exceeds the GSO size?
The uint16_t calculation gso_size - hdr_offset can underflow when the header is larger than gso_size. Separately, the header copy can read beyond the first source segment or write beyond the destination mbuf tailroom.