Description
In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gue_remcsum() passes them to skb_remcsum_process(), whose partial path stores offset - start in the u16 skb->csum_offset variable. If offset is less than start, this underflows. A forwarded packet can retain CHECKSUM_PARTIAL and reach a NETIF_F_HW_CSUM driver which trusts the metadata, leading skb_copy_and_csum_dev() to write two bytes about 64 KiB beyond the destination buffer. Reject reversed tuples in validate_gue_flags(), after the existing length validation, so all GUE parsers enforce the ordering in one place.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fe881ef11cf0220f118816181930494d484c4883 to < 4b9bc21b2396c396d88dd909caaf73d5be6ff593affectedfe881ef11cf0220f118816181930494d484c4883 to < 43efb1f997e976f386aa89716f55870cd2cff9adaffectedfe881ef11cf0220f118816181930494d484c4883 to < 1eeec0c51fd5598da44080ed96bbd9880021c28baffectedfe881ef11cf0220f118816181930494d484c4883 to < 1d664be4ca49d1696e85239236f4988dfc4653c3affectedfe881ef11cf0220f118816181930494d484c4883 to < 97f907203321eee2cc9132d5c9eb47698fb41d35affectedfe881ef11cf0220f118816181930494d484c4883 to < 40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57faffectedfe881ef11cf0220f118816181930494d484c4883 to < c20f755338ca234e523dfc943719f194dfc1f903affectedfe881ef11cf0220f118816181930494d484c4883 to < 2566866fc30965d915d0b52b5c3323b362619f0eaffected
Linux Linux
Default version status: affected
4.0affected0 to < 4.0unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4b9bc21b2396c396d88dd909caaf73d5be6ff593 ↗
- https://git.kernel.org/stable/c/43efb1f997e976f386aa89716f55870cd2cff9ad ↗
- https://git.kernel.org/stable/c/1eeec0c51fd5598da44080ed96bbd9880021c28b ↗
- https://git.kernel.org/stable/c/1d664be4ca49d1696e85239236f4988dfc4653c3 ↗
- https://git.kernel.org/stable/c/97f907203321eee2cc9132d5c9eb47698fb41d35 ↗
- https://git.kernel.org/stable/c/40aeafbcbc7bc4018e8f74bbbb4d29ed8846f57f ↗
- https://git.kernel.org/stable/c/c20f755338ca234e523dfc943719f194dfc1f903 ↗
- https://git.kernel.org/stable/c/2566866fc30965d915d0b52b5c3323b362619f0e ↗