In the Linux kernel, the following vulnerability has been resolved:
tcp: add sanity checks to rx zerocopy
TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs.
This patch adds to can_map_frag() these additional checks:
- Page must not be a compound one. - page->mapping must be NULL.
This fixes the panic reported by ZhangPeng.
syzbot was able to loopback packets built with sendfile(), mapping pages owned by an ext4 file to TCP rx zerocopy.
r3 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10) connect$inet(r4, &(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10) r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181e42, 0x0) fallocate(r5, 0x0, 0x0, 0x85b8) sendfile(r4, r5, 0x0, 0x8ba0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000440)=0x40) r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x181e42, 0x0)
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-kvmUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernelUpgrade kernel-zfcpdump-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-tools-libsUpgrade kernel-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-rt-modules-extraUpgrade kernel-debug-develUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-tools-libs-develUpgrade kernel-64k-modules-coreUpgrade kernel-headersUpgrade kernel-64k-modulesUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade bpftoolUpgrade kernel-64k-debug-modules-extraUpgrade kernel-cross-headersUpgrade rtlaUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-64k-modules-extraUpgrade kernel-modules-extraUpgrade kernel-docUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-debug-develUpgrade kernel-uki-virtUpgrade python3-perfUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade libperfUpgrade kernel-rt-debugUpgrade kernel-64k-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-develUpgrade kernel-rtUpgrade kernel-rt-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-zfcpdumpUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-devel-matchedUpgrade perfUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade rvUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modules | Aug 12, 2024 | Mar 18, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.210-201.852Upgrade kernel-livepatch-5.15.149-99.161Upgrade kernel-tools-develUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade perfUpgrade python-perf-debuginfoUpgrade python-perf | Jul 9, 2024 | Mar 18, 2024 |
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade bpftoolUpgrade kernel-tools-develUpgrade kernelUpgrade perfUpgrade python3-perfUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-livepatch-6.1.77-99.164Upgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64 | Feb 17, 2025 | Mar 18, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs | Jul 16, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Jun 26, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade python3-perf | Oct 8, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-perfUpgrade kernel-develUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-headersUpgrade python3-perf | Jul 23, 2024 | Mar 18, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libs | Jul 17, 2024 | Mar 18, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Mar 18, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Aug 12, 2024 | Mar 18, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-extraUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debugUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel-cross-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade libperfUpgrade kernel-devel-matchedUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernel-debug-develUpgrade rtlaUpgrade kernelUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-coreUpgrade python3-perfUpgrade libperf-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-tools-libs-develUpgrade perfUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-develUpgrade bpftoolUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debugUpgrade kernel-debug-debuginfoUpgrade kernel-uki-virtUpgrade bpftool-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-kvmUpgrade perf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-modulesUpgrade rvUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-develUpgrade kernel-rt | Aug 22, 2024 | Mar 18, 2024 |
| Suse | — | Upgrade kernel-default-develUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-64kb-develUpgrade kernel-source-azureUpgrade kselftests-kmp-azureUpgrade kernel-devel-azureUpgrade gfs2-kmp-defaultUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-source-rtUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-64kb-livepatch-develUpgrade dtb-qcomUpgrade dtb-allwinnerUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-debug-vdsoUpgrade dtb-exynosUpgrade kernel-obs-buildUpgrade kernel-zfcpdumpUpgrade kernel-rt-develUpgrade kernel-sourceUpgrade gfs2-kmp-azureUpgrade kernel-develUpgrade ocfs2-kmp-defaultUpgrade dtb-amazonUpgrade dtb-alteraUpgrade kernel-64kbUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-kvmsmall-develUpgrade kernel-devel-rtUpgrade kernel-rt-optionalUpgrade kernel-default-optionalUpgrade kselftests-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-azure-livepatch-develUpgrade dtb-lgUpgrade dtb-mediatekUpgrade cluster-md-kmp-rtUpgrade kernel-rt-livepatchUpgrade kernel-default-vdsoUpgrade kernel-azureUpgrade gfs2-kmp-rtUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade kernel-azure-develUpgrade dtb-xilinxUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-default-baseUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade dtb-armUpgrade dtb-renesasUpgrade dtb-socionextUpgrade cluster-md-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-docsUpgrade kernel-rt-extraUpgrade dlm-kmp-defaultUpgrade kernel-symsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-syms-rtUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-defaultUpgrade kernel-docs-htmlUpgrade dtb-hisiliconUpgrade reiserfs-kmp-defaultUpgrade dtb-marvellUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade dtb-broadcomUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-macrosUpgrade dlm-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-obs-qaUpgrade dtb-amdUpgrade dtb-apmUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-64kb-optionalUpgrade kernel-rt_debugUpgrade dtb-sprdUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-amlogic | Dec 5, 2025 | Oct 31, 2024 |
| Ubuntu | — | Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1102-gkeopUpgrade linux-image-5.4.0-1123-kvmUpgrade linux-image-5.4.0-1139-gcpUpgrade linux-image-awsUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-azure-cvmUpgrade linux-image-virtualUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-bluefieldUpgrade linux-image-raspi-nolpaeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-ibmUpgrade linux-image-5.15.0-1063-azureUpgrade linux-image-oem-22.04Upgrade linux-image-5.4.0-200-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-5.4.0-1054-xilinx-zynqmpUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-1119-raspiUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-lowlatencyUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-generic-lpaeUpgrade linux-image-gke-5.15Upgrade linux-image-5.4.0-1139-azureUpgrade linux-image-5.4.0-1140-azureUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.5.0-1021-awsUpgrade linux-image-oemUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1134-oracleUpgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-genericUpgrade linux-image-intel-iotgUpgrade linux-image-oem-20.04dUpgrade linux-image-intelUpgrade linux-image-oem-22.04dUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-oem-osp1Upgrade linux-image-6.5.0-41-genericUpgrade linux-image-5.4.0-1082-ibmUpgrade linux-image-azureUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-5.4.0-1094-bluefieldUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-raspi2Upgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-oem-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeUpgrade linux-image-kvmUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-5.4.0-200-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-laptop-23.10Upgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-5.4.0-1135-awsUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-5.4.0-200-genericUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-oem-22.04cUpgrade linux-image-raspiUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-gkeop-5.4Upgrade linux-image-aws-lts-20.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-gkeopUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-starfiveUpgrade linux-image-5.4.0-1044-iot | May 17, 2024 | Mar 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub