CVE-2024-43897

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: drop bad gso csum_start and offset in virtio_net_hdr

Tighten csum_start and csum_offset checks in virtio_net_hdr_to_skb

for GSO packets.

The function already checks that a checksum requested with

VIRTIO_NET_HDR_F_NEEDS_CSUM is in skb linear. But for GSO packets

this might not hold for segs after segmentation.

Syzkaller demonstrated to reach this warning in skb_checksum_help

offset = skb_checksum_start_offset(skb);

ret = -EINVAL;

if (WARN_ON_ONCE(offset >= skb_headlen(skb)))

By injecting a TSO packet:

WARNING: CPU: 1 PID: 3539 at net/core/dev.c:3284 skb_checksum_help+0x3d0/0x5b0

ip_do_fragment+0x209/0x1b20 net/ipv4/ip_output.c:774

ip_finish_output_gso net/ipv4/ip_output.c:279 [inline]

__ip_finish_output+0x2bd/0x4b0 net/ipv4/ip_output.c:301

iptunnel_xmit+0x50c/0x930 net/ipv4/ip_tunnel_core.c:82

ip_tunnel_xmit+0x2296/0x2c70 net/ipv4/ip_tunnel.c:813

__gre_xmit net/ipv4/ip_gre.c:469 [inline]

ipgre_xmit

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References