Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't redirect packets with invalid pkt_len Syzbot found an issue [1]: fq_codel_drop() try to drop a flow whitout any skbs, that is, the flow->head is null. The root cause, as the [2] says, is because that bpf_prog_test_run_skb() run a bpf prog which redirects empty skbs. So we should determine whether the length of the packet modified by bpf prog or others like bpf_prog_test is valid before forwarding it directly.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5293efe62df81908f2e90c9820c7edcc8e61f5e9 to < 8b68e53d56697a59b5c53893b53f508bbdf272a0affected5293efe62df81908f2e90c9820c7edcc8e61f5e9 to < 6204bf78b2a903b96ba43afff6abc0b04d6e0462affected5293efe62df81908f2e90c9820c7edcc8e61f5e9 to < a75987714bd2d8e59840667a28e15c1fa5c47554affected5293efe62df81908f2e90c9820c7edcc8e61f5e9 to < 72f2dc8993f10262092745a88cb2dd0fef094f23affected5293efe62df81908f2e90c9820c7edcc8e61f5e9 to < fd1894224407c484f652ad456e1ce423e89bb3ebaffected
Linux Linux
Default version status: affected
4.9affected0 to < 4.9unaffected5.4.212 to ≤ 5.4.*unaffected5.10.141 to ≤ 5.10.*unaffected5.15.65 to ≤ 5.15.*unaffected5.19.7 to ≤ 5.19.*unaffected6.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8b68e53d56697a59b5c53893b53f508bbdf272a0 ↗
- https://git.kernel.org/stable/c/6204bf78b2a903b96ba43afff6abc0b04d6e0462 ↗
- https://git.kernel.org/stable/c/a75987714bd2d8e59840667a28e15c1fa5c47554 ↗
- https://git.kernel.org/stable/c/72f2dc8993f10262092745a88cb2dd0fef094f23 ↗
- https://git.kernel.org/stable/c/fd1894224407c484f652ad456e1ce423e89bb3eb ↗