CVE-2024-49947

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: test for not too small csum_start in virtio_net_hdr_to_skb()

syzbot was able to trigger this warning [1], after injecting a

malicious packet through af_packet, setting skb->csum_start and thus

the transport header to an incorrect value.

We can at least make sure the transport header is after

the end of the network header (with a estimated minimal size).

[1]

[ 67.873027] skb len=4096 headroom=16 headlen=14 tailroom=0

mac=(-1,-1) mac_len=0 net=(16,-6) trans=10

shinfo(txflags=0 nr_frags=1 gso(size=0 type=0 segs=0))

csum(0xa start=10 offset=0 ip_summed=3 complete_sw=0 valid=0 level=0)

hash(0x0 sw=0 l4=0) proto=0x0800 pkttype=0 iif=0

priority=0x0 mark=0x0 alloc_cpu=10 vlan_all=0x0

encapsulation=0 inner(proto=0x0000, mac=0, net=0, trans=0)

[ 67.877172] dev name=veth0_vlan feat=0x000061164fdd09e9

[ 67.877764] sk family=17 type=3 proto=0

[ 67.878279] skb linear: 00000000: 00 00 10 00 00 00 00 00 0f 00 00 00

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References