CVE-2024-43817

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: missing check virtio

Two missing check in virtio_net_hdr_to_skb() allowed syzbot

to crash kernels again

1. After the skb_segment function the buffer may become non-linear

(nr_frags != 0), but since the SKBTX_SHARED_FRAG flag is not set anywhere

the __skb_linearize function will not be executed, then the buffer will

remain non-linear. Then the condition (offset >= skb_headlen(skb))

becomes true, which causes WARN_ON_ONCE in skb_checksum_help.

2. The struct sk_buff and struct virtio_net_hdr members must be

mathematically related.

(gso_size) must be greater than (needed) otherwise WARN_ON_ONCE.

(remainder) must be greater than (needed) otherwise WARN_ON_ONCE.

(remainder) may be 0 if division is without remainder.

offset+2 (4191) > skb_headlen() (1116)

WARNING: CPU: 1 PID: 5084 at net/core/dev.c:3303 skb_checksum_help+0x5e2/0x740 net/core/dev.c:3303

Modules linked in:

CPU: 1 PID: 5084 Comm: syz-executor336 Not ta

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References