In the Linux kernel, the following vulnerability has been resolved:
net/core: Fix ETH_P_1588 flow dissector
When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is wrong. For example: hdr->message_length takes the wrong value (0xffff) and it does not replicate real header length. In this case, 'nhoff' value was overridden and the PTP header was badly dissected. This leads to a kernel crash.
net/core: flow_dissector net/core flow dissector nhoff = 0x0000000e net/core flow dissector hdr->message_length = 0x0000ffff net/core flow dissector nhoff = 0x0001000d (u16 overflow) ... skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 skb frag: 00000000: f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Using the size of the ptp_header struct will allow the corrected calculation of the nhoff value.
net/core flow dissector nhoff = 0x0000000e net/core flow dissector nhoff = 0x00000030 (sizeof ptp_header) ... skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 f7 ff ff skb linear: 00000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb linear: 00000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb frag: 00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Kernel trace: [ 74.984279] ------------[ cut here ]------------ [ 74.989471] kernel BUG at include/linux/skbuff.h:2440! [ 74.995237] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 75.001098] CPU: 4 PID: 0 Comm: swapper/4 Tainted: G U 5.15.85-intel-ese-standard-lts #1 [ 75.011629] Hardware name: Intel Corporation A-Island (CPU:AlderLake)/A-Island (ID:06), BIOS SB_ADLP.01.01.00.01.03.008.D-6A9D9E73-dirty Mar 30 2023 [ 75.026507] RIP: 0010:eth_type_trans+0xd0/0x130 [ 75.031594] Code: 03 88 47 78 eb c7 8b 47 68 2b 47 6c 48 8b 97 c0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb ab <0f> 0b b8 00 01 00 00 eb a2 48 85 ff 74 eb 48 8d 54 24 06 31 f6 b9 [ 75.052612] RSP: 0018:ffff9948c0228de0 EFLAGS: 00010297 [ 75.058473] RAX: 00000000000003f2 RBX: ffff8e47047dc300 RCX: 0000000000001003 [ 75.066462] RDX: ffff8e4e8c9ea040 RSI: ffff8e4704e0a000 RDI: ffff8e47047dc300 [ 75.074458] RBP: ffff8e4704e2acc0 R08: 00000000000003f3 R09: 0000000000000800 [ 75.082466] R10: 000000000000000d R11: ffff9948c0228dec R12: ffff8e4715e4e010 [ 75.090461] R13: ffff9948c0545018 R14: 0000000000000001 R15: 0000000000000800 [ 75.098464] FS: 0000000000000000(0000) GS:ffff8e4e8fb00000(0000) knlGS:0000000000000000 [ 75.107530] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.113982] CR2: 00007f5eb35934a0 CR3: 0000000150e0a002 CR4: 0000000000770ee0 [ 75.121980] PKRU: 55555554 [ 75.125035] Call Trace: [ 75.127792] <IRQ> [ 75.130063] ? eth_get_headlen+0xa4/0xc0 [ 75.134472] igc_process_skb_fields+0xcd/0x150 [ 75.139461] igc_poll+0xc80/0x17b0 [ 75.143272] __napi_poll+0x27/0x170 [ 75.147192] net_rx_action+0x234/0x280 [ 75.151409] __do_softirq+0xef/0x2f4 [ 75.155424] irq_exit_rcu+0xc7/0x110 [ 75.159432] common_interrupt+0xb8/0xd0 [ 75.163748] </IRQ> [ 75.166112] <TASK> [ 75.168473] asm_common_interrupt+0x22/0x40 [ 75.173175] RIP: 0010:cpuidle_enter_state+0xe2/0x350 [ 75.178749] Code: 85 c0 0f 8f 04 02 00 00 31 ff e8 39 6c 67 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 50 02 00 00 31 ff e8 52 b0 6d ff fb 45 85 f6 <0f> 88 b1 00 00 00 49 63 ce 4c 2b 2c 24 48 89 c8 48 6b d1 68 48 c1 [ 75.199757] RSP: 0018:ffff9948c013bea8 EFLAGS: 00000202 [ 75.205614] RAX: ffff8e4e8fb00000 RBX: ffffb948bfd23900 RCX: 000000000000001f [ 75.213619] RDX: 0000000000000004 RSI: ffffffff94206161 RDI: ffffffff94212e20 [ 75.221620] RBP: 0000000000000004 R08: 000000117568973a R09: 0000000000000001 [ 75.229622] R10: 000000000000afc8 R11: ffff8e4e8fb29ce4 R12: ffffffff945ae980 [ 75.237628] R13: 000000117568973a R14: 0000000000000004 R15: 0000000000000000 [ 75.245635] ? ---truncated---
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modules-coreUpgrade kernel-rtUpgrade kernel-64k-modules-extraUpgrade kernel-docUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-debug-uki-virtUpgrade bpftoolUpgrade kernel-rt-modulesUpgrade kernel-rt-kvmUpgrade kernel-64k-debug-coreUpgrade kernel-rt-develUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-coreUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-64k-debugUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade rvUpgrade kernel-develUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-kvmUpgrade kernel-modulesUpgrade kernel-64k-coreUpgrade kernel-64kUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modulesUpgrade kernel-devel-matchedUpgrade libperfUpgrade kernel-cross-headersUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-64k-modules-coreUpgrade kernel-headersUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-develUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-uki-virtUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-develUpgrade kernel-coreUpgrade rtlaUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-modulesUpgrade kernel-rt-coreUpgrade kernel | May 31, 2024 | Mar 2, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.134-87.145Upgrade bpftoolUpgrade kernel-tools-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-debuginfo | Jul 9, 2024 | Mar 2, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-livepatch-6.1.56-82.125Upgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade bpftoolUpgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-devel | Feb 17, 2025 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Oracle_linux | — | Upgrade kernel | May 14, 2024 | Mar 2, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | May 23, 2024 | Mar 2, 2024 |
| Rocky_linux | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-modulesUpgrade python3-perf-debuginfoUpgrade kernel-coreUpgrade kernel-rt-develUpgrade bpftool-debuginfoUpgrade kernel-debug-debuginfoUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-rtUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-rt-debuginfoUpgrade kernel-debugUpgrade perfUpgrade perf-debuginfoUpgrade kernel-cross-headersUpgrade kernel-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel | Jun 17, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade ocfs2-kmp-azureUpgrade dtb-xilinxUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-develUpgrade dtb-amdUpgrade dtb-sprdUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-debug-develUpgrade dtb-broadcomUpgrade kernel-64kb-develUpgrade kernel-devel-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-extraUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade gfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-default-optionalUpgrade dtb-appleUpgrade kernel-docsUpgrade cluster-md-kmp-64kbUpgrade dtb-socionextUpgrade kernel-rt-livepatchUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-source-vanillaUpgrade kernel-rt-vdsoUpgrade kernel-azureUpgrade kernel-default-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-caviumUpgrade dtb-allwinnerUpgrade dtb-alteraUpgrade dtb-renesasUpgrade kselftests-kmp-azureUpgrade dtb-hisiliconUpgrade dtb-rockchipUpgrade kernel-default-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-debugUpgrade kernel-azure-optionalUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-symsUpgrade dtb-mediatekUpgrade cluster-md-kmp-defaultUpgrade dtb-exynosUpgrade kselftests-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-rtUpgrade dtb-amazonUpgrade kernel-rt_debug-vdsoUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-64kbUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade dtb-amlogicUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-azureUpgrade dtb-freescaleUpgrade dtb-armUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-qaUpgrade dtb-marvellUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade kernel-64kb-livepatch-develUpgrade kernel-sourceUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-devel-azureUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade kernel-default-extra | Aug 15, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-oracle-5.15Upgrade linux-aws-5.15Upgrade linux-lowlatency-hwe-6.5Upgrade linux-nvidia-tegra-5.15Upgrade linux-lowlatencyUpgrade linux-nvidiaUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-5.15Upgrade linux-starfiveUpgrade linux-fipsUpgrade linux-oracle-6.5Upgrade linux-realtimeUpgrade linux-hwe-5.15Upgrade linux-azureUpgrade linux-azure-fdeUpgrade linux-raspiUpgrade linux-ibm-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-oem-6.5Upgrade linux-gkeUpgrade linux-nvidia-tegraUpgrade linux-gkeop-5.15Upgrade linux-riscvUpgrade linux-gcpUpgrade linux-ibmUpgrade linuxUpgrade linux-gcp-6.5Upgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-intel-iotg-5.15Upgrade linux-bluefieldUpgrade linux-intel-iotgUpgrade linux-nvidia-tegra-igxUpgrade linux-intel-iot-realtimeUpgrade linux-riscv-5.15Upgrade linux-gcp-fipsUpgrade linux-nvidia-6.5Upgrade linux-gkeopUpgrade linux-oracleUpgrade linux-laptopUpgrade linux-azure-5.15Upgrade linux-awsUpgrade linux-hwe-6.5 | Nov 19, 2024 | Mar 2, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub