Date: Thu, 6 Aug 2015 00:50:54 -0400 (EDT) From: Wade Mealing <wmealing@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2015-5156 : virt-io max-skb-frags heap overflow. Gday, When a guests KVM network devices is in a bridge configuration the kernel can create a situation in which packets are fragmented in an unexpected fashion. The GRO functionality can create a situation in which multiple SKB's are chained together in a single packets fraglist (by design). The virtio module declares support for NETIF_F_FRAGLIST and assumes that there are at most MAX_SKB_FRAGS + 2 fragments which isn't always true with a fraglist, when GRO is enabled on the incoming driver it can create more fragments than expected. A longer than expected fragment list in the socket buffer will make the call to skb_to_sgvec overflow the sg array, leading to memory corruption, and denial of service. An unprivileged attacker could use this flaw to crash the system resulting in DoS. Red Hat would like to thank Jason Wang for reporting this issue. Upstream fixes: --------------- -> http://marc.info/?l=linux-netdev&m=143868216724068&w=2 Red Hat Bugzilla: ---------------- -> https://bugzilla.redhat.com/show_bug.cgi?id=1243852 Thanks, Wade Mealing
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ