In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net: gro: no fusionar skbs zcopy skb_gro_receive() actualmente puede copiar fragmentos entre el skb de origen y el GRO, sin verificar el estado de zerocopy, y en particular el indicador SKBFL_MANAGED_FRAG_REFS. Cuando SKBFL_MANAGED_FRAG_REFS está establecido, el skb no mantiene una referencia en las páginas en shinfo->frags. Adjuntar esos fragmentos a los fragmentos de otro skb sin corregir el recuento de referencias de la página puede llevar a UAF. Cuando el último skb en la cadena GRO (aquel al que adjuntaríamos fragmentos) o el skb de origen es zerocopy, no fusionar los skbs.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 1.8
Impact Score: 5.9
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-416
|
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary |
en
CWE-123
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23af202600> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23a536f9c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d24246ec500> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23a536fe40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23af201400> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7d23af2035c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7d239fb11980> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7d23a5338a80> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7d239fb10640> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* |