In the Linux kernel, the following vulnerability has been resolved:
inet: inet_defrag: prevent sk release while still in use
ip_local_out() and other functions can pass skb->sk as function argument.
If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released.
This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.
Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing.
A relevant old patch about the issue was : 8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")
[..]
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one.
If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly.
We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used.
Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this:
If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow.
This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered.
This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue.
In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine.
In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-zfcpdump-modulesUpgrade perfUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-develUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-coreUpgrade kernel-cross-headersUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-develUpgrade kernel-debug-modulesUpgrade kernel-tools-libs-devel | Aug 12, 2024 | Apr 18, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-develUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.15.168-114.166Upgrade kernel-tools-develUpgrade kernel-livepatch-5.10.227-219.884Upgrade kernelUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-tools | Nov 4, 2024 | Apr 18, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-6.1.87-99.174Upgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extra-commonUpgrade kernelUpgrade perfUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-devel | Feb 17, 2025 | Apr 18, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade python3-perf | Jul 16, 2024 | Apr 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel | Dec 12, 2024 | Apr 18, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs | Jul 17, 2024 | Apr 18, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | Apr 18, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Aug 12, 2024 | Apr 18, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-develUpgrade kernel-debug-develUpgrade python3-perfUpgrade perf-debuginfoUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-rt-debugUpgrade kernel-tools-libs-develUpgrade kernel-rt-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-rtUpgrade kernel-modulesUpgrade kernelUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debugUpgrade bpftoolUpgrade kernel-cross-headersUpgrade kernel-headers | Aug 22, 2024 | Apr 18, 2024 |
| Suse | — | Upgrade dtb-caviumUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade dtb-amazonUpgrade kernel-rt-develUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-rtUpgrade dtb-renesasUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-armUpgrade dtb-exynosUpgrade kernel-obs-qaUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-default-develUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade cluster-md-kmp-defaultUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-preempt-develUpgrade kernel-devel-rtUpgrade kernel-debug-develUpgrade dtb-xilinxUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-rtUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-livepatch-develUpgrade dlm-kmp-azureUpgrade kernel-symsUpgrade dtb-apmUpgrade kernel-default-extraUpgrade kernel-develUpgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade kernel-64kbUpgrade dtb-socionextUpgrade kernel-source-azureUpgrade dtb-rockchipUpgrade gfs2-kmp-azureUpgrade dtb-qcomUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-extraUpgrade kselftests-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-optionalUpgrade dtb-lgUpgrade kernel-preemptUpgrade dtb-sprdUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade ocfs2-kmp-64kbUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade kernel-64kb-extraUpgrade dtb-freescaleUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade kernel-macrosUpgrade kernel-rt-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-defaultUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-default-livepatchUpgrade kernel-kvmsmallUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade kernel-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-baseUpgrade dtb-marvellUpgrade kernel-rt-optionalUpgrade kernel-azure-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade dlm-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-azure-vdsoUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-broadcomUpgrade kernel-default-manUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-debug-vdsoUpgrade dtb-amlogicUpgrade kernel-rt-vdsoUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-vdso | Jun 12, 2024 | Apr 18, 2024 |
| Ubuntu | — | Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-5.4.0-1131-awsUpgrade linux-image-5.15.0-1061-ibmUpgrade linux-image-4.4.0-1143-kvmUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-oem-osp1Upgrade linux-image-5.15.0-119-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-193-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1063-nvidiaUpgrade linux-image-gcpUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-azureUpgrade linux-image-4.15.0-1184-azureUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1071-azure-fdeUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-119-lowlatency-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-4.15.0-1176-awsUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-awsUpgrade linux-image-azure-cvmUpgrade linux-image-4.4.0-267-lowlatencyUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.4.0-1091-bluefieldUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-4.4.0-1112-fipsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.15.0-119-genericUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.15.0-1071-azureUpgrade linux-image-4.4.0-1142-awsUpgrade linux-image-raspi2Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-azure-lts-18.04Upgrade linux-image-5.15.0-1063-nvidia-lowlatencyUpgrade linux-image-5.4.0-1136-azureUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-oem-20.04dUpgrade linux-image-4.15.0-1159-kvmUpgrade linux-image-kvmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1130-oracleUpgrade linux-image-4.15.0-1169-gcpUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-intelUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.4.0-1078-ibmUpgrade linux-image-5.15.0-1065-kvmUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1067-gcpUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1135-gcpUpgrade linux-image-5.15.0-1068-awsUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1066-oracleUpgrade linux-image-5.15.0-1065-gkeUpgrade linux-image-fipsUpgrade linux-image-gkeop-5.4Upgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-oracleUpgrade linux-image-5.4.0-193-generic-lpaeUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gkeopUpgrade linux-image-4.4.0-1180-awsUpgrade linux-image-5.4.0-193-genericUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-5.4.0-1043-iotUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1050-xilinx-zynqmpUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-4.15.0-1138-oracleUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-generic-64kUpgrade linux-image-5.4.0-1119-kvmUpgrade linux-image-nvidiaUpgrade linux-image-generic-lts-xenialUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-gkeUpgrade linux-image-5.4.0-1098-gkeopUpgrade linux-image-bluefieldUpgrade linux-image-oemUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1063-intel-iotgUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-4.4.0-267-genericUpgrade linux-image-5.4.0-1115-raspiUpgrade linux-image-4.15.0-232-lowlatencyUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-aws-lts-18.04Upgrade linux-image-oem-20.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-aws-hweUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-5.15.0-119-generic-64kUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-119-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-4.15.0-232-genericUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1051-gkeopUpgrade linux-image-5.15.0-1061-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-gcp-lts-22.04 | Jul 12, 2024 | Apr 18, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 18, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub