Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 Nov 2013 18:34:38 +0100
From: Petr Matousek <>
Cc: Kurt Seifried <>,
Subject: CVE-2013-4563 -- Linux kernel: net: large udp packet over IPv6 over
 UFO-enabled device with TBF qdisc panic

Commit 1e2bd517c108816220f262d7954b697af03b5f9c ("udp6: Fix udp
fragmentation for tunnel traffic.") changed the calculation if
there is enough space to include a fragment header in the skb from a
skb->mac_header dervived one to skb_headroom. Because we already peeled
off the skb to transport_header this is wrong.

This fixes a panic Saran Neti reported. He used the tbf scheduler which
skb_gso_segments the skb. The offsets get negative and we panic in
memcpy because the skb was erroneously not expanded at the head.

Introduced by:

Introduced in:

Upstream fix:



Red Hat would like to thank Saran Neti of TELUS Security Labs for
reporting this issue.

Petr Matousek / Red Hat Security Response Team

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ