Description
In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit program ip_finish_output2() expands an skb to LL_RESERVED_SPACE(dev) before LWT xmit. An LWT_XMIT BPF program can then modify the skb head and still return BPF_OK, so bpf_xmit() rechecks the remaining headroom before the skb continues to neighbour output. That recheck uses dst->dev->hard_header_len. This is not enough for the neighbour cached-header path: neigh_hh_output() copies the cached hardware header using the aligned hh_cache size, HH_DATA_MOD for short headers or HH_DATA_ALIGN(hh_len) otherwise. On Ethernet, hard_header_len is 14 but the cached copy needs 16 bytes. If an LWT_XMIT BPF program calls bpf_skb_change_head(skb, 1, 0), the skb can still have 15 bytes of headroom after the program. The existing check accepts that, after which neigh_hh_output() hits its headroom warning and drops the skb. Use LL_RESERVED_SPACE(dst->dev) in the post-BPF headroom check to match the reservation made before LWT xmit.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < 753e5cdcca5474d230d62bb3489e5168ab27c272affected3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < c488071c3441fa34f5a87cd6c12ce2cc6304f20eaffected3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < a38c0eb447e2dd0120a2ebcdba470f9505ac8907affected3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < de2b2004e16f2930eb689175e2c1998b0a68d499affected3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < 7d043e24520a273c362be5dd7d9c82796879a49baffected3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < 7cf561843ed0ad57501892a65abb77957e6c800faffected3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < 179a5b2171573d94a25c9aa8e1c9f9ac352ad316affected3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 to < 5fe7007aed9ad069b2bd77e5d0c875c64f5c0269affected
Linux Linux
Default version status: affected
4.10affected0 to < 4.10unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/753e5cdcca5474d230d62bb3489e5168ab27c272 ↗
- https://git.kernel.org/stable/c/c488071c3441fa34f5a87cd6c12ce2cc6304f20e ↗
- https://git.kernel.org/stable/c/a38c0eb447e2dd0120a2ebcdba470f9505ac8907 ↗
- https://git.kernel.org/stable/c/de2b2004e16f2930eb689175e2c1998b0a68d499 ↗
- https://git.kernel.org/stable/c/7d043e24520a273c362be5dd7d9c82796879a49b ↗
- https://git.kernel.org/stable/c/7cf561843ed0ad57501892a65abb77957e6c800f ↗
- https://git.kernel.org/stable/c/179a5b2171573d94a25c9aa8e1c9f9ac352ad316 ↗
- https://git.kernel.org/stable/c/5fe7007aed9ad069b2bd77e5d0c875c64f5c0269 ↗