In the Linux kernel, the following vulnerability has been resolved:
tcp: add sanity checks to rx zerocopy
TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs.
This patch adds to can_map_frag() these additional checks:
- Page must not be a compound one. - page->mapping must be NULL.
This fixes the panic reported by ZhangPeng.
syzbot was able to loopback packets built with sendfile(), mapping pages owned by an ext4 file to TCP rx zerocopy.
r3 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10) connect$inet(r4, &(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10) r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181e42, 0x0) fallocate(r5, 0x0, 0x0, 0x85b8) sendfile(r4, r5, 0x0, 0x8ba0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000440)=0x40) r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181e42, 0x0)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modules-extraUpgrade kernel-docUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade perfUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-64k-modules-extraUpgrade kernel-coreUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-toolsUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-rt-develUpgrade kernel-debug-uki-virtUpgrade rvUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-64k-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-libsUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-develUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-64k-modules-coreUpgrade kernel-rt-modules-extraUpgrade rtlaUpgrade kernel-zfcpdump-modulesUpgrade kernel-64kUpgrade kernel-debug-develUpgrade kernel-headersUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-cross-headersUpgrade kernel-debugUpgrade kernel-tools-libs-develUpgrade bpftoolUpgrade kernel-rt-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-modules-extra | Aug 12, 2024 | Mar 18, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade kernel-livepatch-5.10.210-201.852Upgrade kernel-headersUpgrade python-perfUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.149-99.161Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64 | Jul 9, 2024 | Mar 18, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.1.77-99.164Upgrade kernel-libbpfUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-develUpgrade bpftoolUpgrade kernelUpgrade perf | Feb 17, 2025 | Mar 18, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-tools | Jul 16, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelists | Jun 26, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade bpftool | Oct 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-perfUpgrade kernel-develUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-headersUpgrade perf | Jul 23, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel | Jul 17, 2024 | Mar 18, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Mar 18, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Aug 12, 2024 | Mar 18, 2024 |
| Rocky_linux | — | Upgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade python3-perfUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-debug-develUpgrade kernel-devel-matchedUpgrade rtlaUpgrade kernel-rt-debuginfo-common-x86_64Upgrade libperfUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-coreUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-kvmUpgrade kernelUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-cross-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-develUpgrade kernel-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade kernel-rtUpgrade bpftoolUpgrade perfUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-uki-virtUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade rvUpgrade kernel-rt-modulesUpgrade perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perf-debuginfoUpgrade libperf-debuginfoUpgrade kernel-debug-debuginfo | Aug 22, 2024 | Mar 18, 2024 |
| Suse | — | Upgrade dtb-marvellUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-obs-qaUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade dtb-apmUpgrade kernel-64kb-optionalUpgrade kernel-macrosUpgrade dtb-hisiliconUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade kernel-azure-extraUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-default-baseUpgrade kernel-azure-vdsoUpgrade dtb-socionextUpgrade dtb-renesasUpgrade dtb-armUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade kernel-rt-extraUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade kernel-debug-develUpgrade dtb-nvidiaUpgrade dlm-kmp-defaultUpgrade kernel-default-extraUpgrade cluster-md-kmp-64kbUpgrade dtb-appleUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amdUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-extraUpgrade dtb-broadcomUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade kernel-syms-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-source-azureUpgrade dtb-xilinxUpgrade kernel-rtUpgrade kernel-rt-develUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-default-optionalUpgrade cluster-md-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-lgUpgrade dtb-mediatekUpgrade kernel-rt-livepatchUpgrade kernel-obs-buildUpgrade kernel-rt-optionalUpgrade dtb-amazonUpgrade kernel-default-vdsoUpgrade kernel-azureUpgrade kernel-sourceUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade kernel-source-vanillaUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade kernel-64kbUpgrade dtb-qcomUpgrade kernel-azure-optionalUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade kernel-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-develUpgrade ocfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-source-rtUpgrade dtb-freescaleUpgrade kernel-azure-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-kvmsmall | Dec 5, 2025 | Oct 31, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1061-awsUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-5.4.0-1044-iotUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.4.0-1135-awsUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-oem-20.04bUpgrade linux-image-starfiveUpgrade linux-image-raspi2Upgrade linux-image-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-gkeop-5.4Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-oem-20.04cUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-oem-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-laptop-23.10Upgrade linux-image-intelUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-nvidia-6.5Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-gkeopUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-gkeUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-azureUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-oem-20.04dUpgrade linux-image-nvidiaUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-kvmUpgrade linux-image-virtualUpgrade linux-image-azure-lts-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-ibmUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-5.4.0-1139-azureUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-awsUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oemUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-bluefieldUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-oracleUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-5.15.0-1063-azureUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.5.0-1021-nvidia | May 17, 2024 | Mar 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub