CVE-2024-49947

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-49947
In the Linux kernel, the following vulnerability has been resolved: net: test for not too small csum_start in virtio_net_hdr_to_skb() syzbot was able to trigger this warning [1], after injecting a malicious packet through af_packet, setting skb->csum_start and thus the transport header to an incorrect value. We can at least make sure the transport header is after the end of the network header (with a estimated minimal size). [1] [ 67.873027] skb len=4096 headroom=16 headlen=14 tailroom=0 mac=(-1,-1) mac_len=0 net=(16,-6) trans=10 shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0)) csum(0xa start=10 offset=0 ip_summed=3 complete_sw=0 valid=0 level=0) hash(0x0 sw=0 l4=0) proto=0x0800 pkttype=0 iif=0 priority=0x0 mark=0x0 alloc_cpu=10 vlan_all=0x0 encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0) [ 67.877172] dev name=veth0_vlan feat=0x000061164fdd09e9 [ 67.877764] sk family=17 type=3 proto=0 [ 67.878279] skb linear: 00000000: 00 00 10 00 00 00 00 00 0f 00 00 00 08 00 [ 67.879128] skb frag: 00000000: 0e 00 07 00 00 00 28 00 08 80 1c 00 04 00 00 02 [ 67.879877] skb frag: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.880647] skb frag: 00000020: 00 00 02 00 00 00 08 00 1b 00 00 00 00 00 00 00 [ 67.881156] skb frag: 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.881753] skb frag: 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.882173] skb frag: 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.882790] skb frag: 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883171] skb frag: 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883733] skb frag: 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.884206] skb frag: 00000090: 00 00 00 00 00 00 00 00 00 00 69 70 76 6c 61 6e [ 67.884704] skb frag: 000000a0: 31 00 00 00 00 00 00 00 00 00 2b 00 00 00 00 00 [ 67.885139] skb frag: 000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.885677] skb frag: 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886042] skb frag: 000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886408] skb frag: 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887020] skb frag: 000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887384] skb frag: 00000100: 00 00 [ 67.887878] ------------[ cut here ]------------ [ 67.887908] offset (-6) >= skb_headlen() (14) [ 67.888445] WARNING: CPU: 10 PID: 2088 at net/core/dev.c:3332 skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.889353] Modules linked in: macsec macvtap macvlan hsr wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 libchacha poly1305_x86_64 dummy bridge sr_mod cdrom evdev pcspkr i2c_piix4 9pnet_virtio 9p 9pnet netfs [ 67.890111] CPU: 10 UID: 0 PID: 2088 Comm: b363492833 Not tainted 6.11.0-virtme #1011 [ 67.890183] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.890309] RIP: 0010:skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891043] Call Trace: [ 67.891173] <TASK> [ 67.891274] ? __warn (kernel/panic.c:741) [ 67.891320] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891333] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 67.891348] ? handle_bug (arch/x86/kernel/traps.c:239) [ 67.891363] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 67.891372] ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) [ 67.891388] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891399] ? skb_checksum_help (net/core/dev.c:3332 (discriminator 2)) [ 67.891416] ip_do_fragment (net/ipv4/ip_output.c:777 (discriminator 1)) [ 67.891448] ? __ip_local_out (./include/linux/skbuff.h:1146 ./include/net/l3mdev.h:196 ./include/net/l3mdev.h:213 ne ---truncated---

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/49d14b54a527289d09a9480f214b8c586322310a Patch
https://git.kernel.org/stable/c/4cc0648e9e3240496835dc698ace1d046d8d57ea Patch
https://git.kernel.org/stable/c/7711c419a915ee0dd91c125d2b967bbf2a72e9ac Patch
https://git.kernel.org/stable/c/d9dfd41e32ccc5198033ddd1ff1516822dfefa5a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
History

12 Nov 2024, 21:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/49d14b54a527289d09a9480f214b8c586322310a - () https://git.kernel.org/stable/c/49d14b54a527289d09a9480f214b8c586322310a - Patch
References () https://git.kernel.org/stable/c/4cc0648e9e3240496835dc698ace1d046d8d57ea - () https://git.kernel.org/stable/c/4cc0648e9e3240496835dc698ace1d046d8d57ea - Patch
References () https://git.kernel.org/stable/c/7711c419a915ee0dd91c125d2b967bbf2a72e9ac - () https://git.kernel.org/stable/c/7711c419a915ee0dd91c125d2b967bbf2a72e9ac - Patch
References () https://git.kernel.org/stable/c/d9dfd41e32ccc5198033ddd1ff1516822dfefa5a - () https://git.kernel.org/stable/c/d9dfd41e32ccc5198033ddd1ff1516822dfefa5a - Patch
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

23 Oct 2024, 15:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: prueba de que csum_start no sea demasiado pequeño en virtio_net_hdr_to_skb() syzbot pudo activar esta advertencia [1], después de inyectar un paquete malicioso a través de af_packet, configurando skb-&gt;csum_start y, por lo tanto, el encabezado de transporte con un valor incorrecto. Al menos podemos asegurarnos de que el encabezado de transporte esté después del final del encabezado de red (con un tamaño mínimo estimado). [1] [ 67.873027] longitud skb=4096 espacio libre=16 longitud libre=14 espacio libre=0 mac=(-1,-1) longitud_mac=0 red=(16,-6) trans=10 shinfo(txflags=0 nr_frags=1 gso(tamaño=0 tipo=0 segmentos=0)) suma_c(0xa inicio=10 desplazamiento=0 suma_ip=3 software_completo=0 válido=0 nivel=0) hash(0x0 software=0 l4=0) proto=0x0800 tipo_paquete=0 iif=0 prioridad=0x0 marca=0x0 asignar_cpu=10 vlan_all=0x0 encapsulación=0 interno(proto=0x0000, mac=0, red=0, trans=0) [ 67.877172] nombre_de_desarrollo=veth0_vlan hazaña=0x000061164fdd09e9 [ 67.877764] familia sk=17 tipo=3 proto=0 [ 67.878279] skb lineal: 00000000: 00 00 10 00 00 00 00 00 0f 00 00 00 08 00 [ 67.879128] fragmento skb: 00000000: 0e 00 07 00 00 00 28 00 08 80 1c 00 04 00 00 02 [ 67.879877] fragmento skb: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.880647] skb frag: 00000020: 00 00 02 00 00 00 08 00 1b 00 00 00 00 00 00 00 [ 67.881156] skb frag: 0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [67.881753] skb frag: 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [67.882173] fragmento de skb: 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [67.882790] fragmento de skb: 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883171] skb frag: 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.883733] fragmento: 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.884206] fragmento skb: 00000090: 00 00 00 00 00 00 00 00 00 00 69 70 76 6c 61 6e [ 67.884704] fragmento skb: 000000a0: 31 00 00 00 00 00 00 00 00 00 2b 00 00 00 00 00 [ 67.885139] fragmento skb: 000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.885677] fragmento de skb: 000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886042] fragmento de skb: 000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.886408] fragmento de skb: 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887020] fragmento skb: 000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.887384] fragmento skb: 00000100: 00 00 [ 67.887878] ------------[ cortar aquí ]------------ [ 67.887908] desplazamiento (-6) &gt;= skb_headlen() (14) [ 67.888445] ADVERTENCIA: CPU: 10 PID: 2088 en net/core/dev.c:3332 skb_checksum_help (net/core/dev.c:3332 (discriminador 2)) [ 67.889353] Módulos vinculados en: macsec macvtap macvlan hsr wireguard curve25519_x86_64 libcurve25519_generic libchacha20poly1305 chacha_x86_64 libchacha poly1305_x86_64 puente ficticio sr_mod cdrom evdev pcspkr i2c_piix4 9pnet_virtio 9p 9pnet netfs [ 67.890111] CPU: 10 UID: 0 PID: 2088 Comm: b363492833 No contaminado 6.11.0-virtme #1011 [ 67.890183] Nombre del hardware: QEMU PC estándar (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 01/04/2014 [ 67.890309] RIP: 0010:skb_checksum_help (net/core/dev.c:3332 (discriminador 2)) [ 67.891043] Seguimiento de llamadas: [ 67.891173] [ 67.891274] ? __warn (kernel/panic.c:741) [ 67.891320] ? skb_checksum_help (net/core/dev.c:3332 (discriminador 2)) [ 67.891333] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 67.891348] ? handle_bug (arch/x86/kernel/traps.c:239) [ 67.891363] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminador 1)) [ ---truncado---

21 Oct 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 18:15

Updated : 2024-11-12 21:25

NVD link : CVE-2024-49947

Mitre link : CVE-2024-49947

CVE.ORG link : CVE-2024-49947

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo