Связанные уязвимости
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
[REJECTED CVE] A use-after-free vulnerability was identified in the Linux kernel's net subsystem, specifically in skbuff handling. The issue arises from an overflow of the skb->network_header (a u16 value), causing skb_network_offset(skb) to return a negative value. This results in the __skb_pull() function incorrectly adjusting skb->data to an invalid memory location outside the skb->head area. An attacker could exploit this flaw to cause memory corruption or crash the system, potentially leading to denial of service or other undefined behavior.
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: add overflow debug check to pull/push helpers syzbot managed to trigger following splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x4a3b/0x5e50 Read of size 1 at addr ffff888208a4000e by task a.out/2313 [..] __skb_flow_dissect+0x4a3b/0x5e50 __skb_get_hash+0xb4/0x400 ip_tunnel_xmit+0x77e/0x26f0 ipip_tunnel_xmit+0x298/0x410 .. Analysis shows that the skb has a valid ->head, but bogus ->data pointer. skb->data gets its bogus value via the neigh layer, which does: 1556 __skb_pull(skb, skb_network_offset(skb)); ... and the skb was already dodgy at this point: skb_network_offset(skb) returns a negative value due to an earlier overflow of skb->network_header (u16). __skb_pull thus "adjusts" skb->data by a huge offset, pointing outside skb->head area. Allow debug builds to splat when we try to pull/push more than INT_MAX bytes. After this, the syzkaller reproducer yields a more pr...