Date: Thu, 13 Oct 2016 18:10:41 +0200 From: Marcus Meissner <meissner@...e.de> To: OSS Security List <oss-security@...ts.openwall.com>, cve-assign@...re.org Subject: CVE Request: another recursion in GRE Hi, While debugging the issue CVE-2016-7039, SUSE engineer Michal Kubecek also spotted a similar problem fixed earlier this year. If a packet has the layout: | IPv4 header | GRE header | IPv4 header | GRE header | ... depending on left over stack it could run the kernel out of stack due to recursion and so crash the kernel. This might be hard to hit with regular Ethernet MTUs, but easier with Jumbo frames. Michal has a testcase in https://bugzilla.suse.com/show_bug.cgi?id=1001486#c5 As far as I see fixed in 4.6, introduced in 3.13 (bf5a755f). commit fac8e0f579695a3ecbc4d3cac369139d7f819971 Author: Jesse Gross <jesse@...nel.org> Date: Sat Mar 19 09:32:01 2016 -0700 tunnels: Don't apply GRO to multiple layers of encapsulation. When drivers express support for TSO of encapsulated packets, they only mean that they can do it for one layer of encapsulation. Supporting additional levels would mean updating, at a minimum, more IP length fields and they are unaware of this. No encapsulation device expresses support for handling offloaded encapsulated packets, so we won't generate these types of frames in the transmit path. However, GRO doesn't have a check for multiple levels of encapsulation and will attempt to build them. UDP tunnel GRO actually does prevent this situation but it only handles multiple UDP tunnels stacked on top of each other. This generalizes that solution to prevent any kind of tunnel stacking that would cause problems. Fixes: bf5a755f ("net-gre-gro: Add GRE support to the GRO stack") Signed-off-by: Jesse Gross <jesse@...nel.org> Signed-off-by: David S. Miller <davem@...emloft.net> Ciao, Marcus
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.