In the Linux kernel, the following vulnerability has been resolved:
net/core: Fix ETH_P_1588 flow dissector
When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is wrong. For example: hdr->message_length takes the wrong value (0xffff) and it does not replicate real header length. In this case, 'nhoff' value was overridden and the PTP header was badly dissected. This leads to a kernel crash.
net/core: flow_dissector net/core flow dissector nhoff = 0x0000000e net/core flow dissector hdr->message_length = 0x0000ffff net/core flow dissector nhoff = 0x0001000d (u16 overflow) ... skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 skb frag: 00000000: f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Using the size of the ptp_header struct will allow the corrected calculation of the nhoff value.
net/core flow dissector nhoff = 0x0000000e net/core flow dissector nhoff = 0x00000030 (sizeof ptp_header) ... skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 f7 ff ff skb linear: 00000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb linear: 00000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb frag: 00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Kernel trace: [ 74.984279] ------------[ cut here ]------------ [ 74.989471] kernel BUG at include/linux/skbuff.h:2440! [ 74.995237] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 75.001098] CPU: 4 PID: 0 Comm: swapper/4 Tainted: G U 5.15.85-intel-ese-standard-lts #1 [ 75.011629] Hardware name: Intel Corporation A-Island (CPU:AlderLake)/A-Island (ID:06), BIOS SB_ADLP.01.01.00.01.03.008.D-6A9D9E73-dirty Mar 30 2023 [ 75.026507] RIP: 0010:eth_type_trans+0xd0/0x130 [ 75.031594] Code: 03 88 47 78 eb c7 8b 47 68 2b 47 6c 48 8b 97 c0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb ab <0f> 0b b8 00 01 00 00 eb a2 48 85 ff 74 eb 48 8d 54 24 06 31 f6 b9 [ 75.052612] RSP: 0018:ffff9948c0228de0 EFLAGS: 00010297 [ 75.058473] RAX: 00000000000003f2 RBX: ffff8e47047dc300 RCX: 0000000000001003 [ 75.066462] RDX: ffff8e4e8c9ea040 RSI: ffff8e4704e0a000 RDI: ffff8e47047dc300 [ 75.074458] RBP: ffff8e4704e2acc0 R08: 00000000000003f3 R09: 0000000000000800 [ 75.082466] R10: 000000000000000d R11: ffff9948c0228dec R12: ffff8e4715e4e010 [ 75.090461] R13: ffff9948c0545018 R14: 0000000000000001 R15: 0000000000000800 [ 75.098464] FS: 0000000000000000(0000) GS:ffff8e4e8fb00000(0000) knlGS:0000000000000000 [ 75.107530] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.113982] CR2: 00007f5eb35934a0 CR3: 0000000150e0a002 CR4: 0000000000770ee0 [ 75.121980] PKRU: 55555554 [ 75.125035] Call Trace: [ 75.127792] <IRQ> [ 75.130063] ? eth_get_headlen+0xa4/0xc0 [ 75.134472] igc_process_skb_fields+0xcd/0x150 [ 75.139461] igc_poll+0xc80/0x17b0 [ 75.143272] __napi_poll+0x27/0x170 [ 75.147192] net_rx_action+0x234/0x280 [ 75.151409] __do_softirq+0xef/0x2f4 [ 75.155424] irq_exit_rcu+0xc7/0x110 [ 75.159432] common_interrupt+0xb8/0xd0 [ 75.163748] </IRQ> [ 75.166112] <TASK> [ 75.168473] asm_common_interrupt+0x22/0x40 [ 75.173175] RIP: 0010:cpuidle_enter_state+0xe2/0x350 [ 75.178749] Code: 85 c0 0f 8f 04 02 00 00 31 ff e8 39 6c 67 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 50 02 00 00 31 ff e8 52 b0 6d ff fb 45 85 f6 <0f> 88 b1 00 00 00 49 63 ce 4c 2b 2c 24 48 89 c8 48 6b d1 68 48 c1 [ 75.199757] RSP: 0018:ffff9948c013bea8 EFLAGS: 00000202 [ 75.205614] RAX: ffff8e4e8fb00000 RBX: ffffb948bfd23900 RCX: 000000000000001f [ 75.213619] RDX: 0000000000000004 RSI: ffffffff94206161 RDI: ffffffff94212e20 [ 75.221620] RBP: 0000000000000004 R08: 000000117568973a R09: 0000000000000001 [ 75.229622] R10: 000000000000afc8 R11: ffff8e4e8fb29ce4 R12: ffffffff945ae980 [ 75.237628] R13: 000000117568973a R14: 0000000000000004 R15: 0000000000000000 [ 75.245635] ? ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-perfUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debugUpgrade kernel-tools-libs-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rtUpgrade kernel-debug-uki-virtUpgrade bpftoolUpgrade kernel-rt-debug-modules-coreUpgrade kernel-docUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade rvUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-64k-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-uki-virtUpgrade kernel-64k-develUpgrade kernel-64k-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-modulesUpgrade kernel-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-64k-coreUpgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade kernel-64kUpgrade kernel-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-abi-stablelistsUpgrade libperfUpgrade kernel-debug-develUpgrade kernel-headersUpgrade kernelUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade rtlaUpgrade kernel-rt-core | May 31, 2024 | Mar 2, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.134-87.145Upgrade perfUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade bpftool-debuginfo | Jul 9, 2024 | Mar 2, 2024 |
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-libbpf-staticUpgrade kernelUpgrade kernel-libbpf-develUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-libbpfUpgrade python3-perfUpgrade kernel-livepatch-6.1.56-82.125Upgrade kernel-devel | Feb 17, 2025 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Oracle_linux | — | Upgrade kernel | May 14, 2024 | Mar 2, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | May 23, 2024 | Mar 2, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debugUpgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-modulesUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rtUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-libsUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extraUpgrade kernel-rt-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfoUpgrade python3-perfUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-coreUpgrade kernel-cross-headersUpgrade perfUpgrade kernel-rt-debug-modules-extra | Jun 17, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-obs-buildUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade dtb-renesasUpgrade kselftests-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-devel-rtUpgrade kernel-rt-extraUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade dtb-alteraUpgrade dtb-appleUpgrade kernel-default-baseUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-rt-optionalUpgrade kernel-rt-vdsoUpgrade kernel-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-docsUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade dtb-xilinxUpgrade dlm-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade kernel-debugUpgrade kernel-64kb-extraUpgrade kernel-debug-develUpgrade kernel-develUpgrade dtb-amdUpgrade kernel-default-optionalUpgrade dtb-socionextUpgrade dtb-hisiliconUpgrade dtb-allwinnerUpgrade cluster-md-kmp-rtUpgrade dtb-broadcomUpgrade kernel-debug-vdsoUpgrade dtb-rockchipUpgrade kernel-azure-extraUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-rtUpgrade dtb-caviumUpgrade gfs2-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-rtUpgrade dtb-amazonUpgrade kernel-macrosUpgrade kernel-default-base-rebuildUpgrade kernel-devel-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade kernel-sourceUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-optionalUpgrade kernel-default-extraUpgrade kernel-kvmsmall-develUpgrade dtb-qcomUpgrade dtb-amlogicUpgrade dtb-armUpgrade cluster-md-kmp-azureUpgrade kernel-docs-htmlUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade cluster-md-kmp-defaultUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-defaultUpgrade dtb-marvellUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-azure-develUpgrade dtb-lgUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade kernel-source-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade dlm-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-syms-azure | Aug 15, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-oracle-5.15Upgrade linux-azureUpgrade linux-gkeUpgrade linux-ibm-5.15Upgrade linux-nvidia-tegraUpgrade linux-realtimeUpgrade linux-xilinx-zynqmpUpgrade linux-aws-5.15Upgrade linux-starfiveUpgrade linux-oem-6.5Upgrade linux-azure-fdeUpgrade linux-nvidiaUpgrade linux-gkeop-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-raspiUpgrade linux-oracle-6.5Upgrade linux-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-fipsUpgrade linux-nvidia-tegra-5.15Upgrade linux-lowlatency-hwe-6.5Upgrade linux-riscvUpgrade linux-intel-iot-realtimeUpgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-gcp-fipsUpgrade linux-gcp-6.5Upgrade linuxUpgrade linux-azure-5.15Upgrade linux-awsUpgrade linux-laptopUpgrade linux-hwe-6.5Upgrade linux-gcpUpgrade linux-riscv-5.15Upgrade linux-gkeopUpgrade linux-ibmUpgrade linux-intel-iotgUpgrade linux-nvidia-tegra-igxUpgrade linux-intel-iotg-5.15Upgrade linux-oracleUpgrade linux-nvidia-6.5Upgrade linux-bluefield | Nov 19, 2024 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub