Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade kernel | Oct 27, 2017 | Aug 10, 2017 |
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Oct 25, 2017 | Oct 4, 2017 |
| Debian | — | Upgrade linux | Dec 5, 2017 | Sep 20, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-debuginfoUpgrade kernel-debugUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel-develUpgrade python-perfUpgrade perfUpgrade kernel-tools | Nov 30, 2017 | Oct 4, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-debug-develUpgrade perfUpgrade kernel-debugUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernelUpgrade kernel-headers | Nov 30, 2017 | Oct 4, 2017 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 20, 2017 | Aug 10, 2017 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Oct 25, 2017 | Oct 4, 2017 |
| Suse | — | Upgrade kernel-obs-buildUpgrade dlm-kmp-defaultUpgrade kernel-ec2-extraUpgrade kernel-docsUpgrade kernel-ec2Upgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-ec2-develUpgrade cluster-network-kmp-default | Oct 11, 2017 | Aug 11, 2017 |
| Ubuntu | — | Upgrade linux-image-3.13.0-128-powerpc64-smpUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-4.4.0-91-powerpc-e500mcUpgrade linux-image-4.4.0-91-genericUpgrade linux-image-3.13.0-128-powerpc64-embUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-4.4.0-91-powerpc64-embUpgrade linux-image-genericUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-gkeUpgrade linux-image-4.10.0-32-genericUpgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-3.13.0-128-generic-lpaeUpgrade linux-image-powerpc-smpUpgrade linux-image-4.10.0-32-lowlatencyUpgrade linux-image-4.4.0-91-lowlatencyUpgrade linux-image-3.13.0-128-genericUpgrade linux-image-4.4.0-91-powerpc-smpUpgrade linux-image-raspi2Upgrade linux-image-powerpc64-embUpgrade linux-image-4.4.0-91-generic-lpaeUpgrade linux-image-3.13.0-128-powerpc-smpUpgrade linux-image-powerpc64-smp-lts-xenialUpgrade linux-image-3.13.0-128-powerpc-e500Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-3.13.0-128-powerpc-e500mcUpgrade linux-image-4.4.0-1069-raspi2Upgrade linux-image-3.13.0-128-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-4.4.0-1071-snapdragonUpgrade linux-image-4.4.0-1030-awsUpgrade linux-image-4.10.0-32-generic-lpaeUpgrade linux-image-powerpc-e500Upgrade linux-image-generic-lpae-lts-trustyUpgrade linux-image-4.4.0-1026-gkeUpgrade linux-image-awsUpgrade linux-image-4.10.0-1015-raspi2Upgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-powerpc-e500mcUpgrade linux-image-snapdragonUpgrade linux-image-generic-lts-xenialUpgrade linux-image-generic-lts-trustyUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.4.0-91-powerpc64-smpUpgrade linux-image-powerpc64-smp | Dec 20, 2017 | Aug 11, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 4, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub