Поиск уязвимостей

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.

xfrm: fix stale skb->prev after async crypto steals a GSO segment

In the Linux kernel, the following vulnerability has been resolved: x ...

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free. Repoint skb->prev at the last retained segment before returning.

Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)

Security update for the Linux Kernel (Live Patch 83 for SUSE Linux Enterprise 12 SP5)

Security update for the Linux Kernel (Live Patch 84 for SUSE Linux Enterprise 12 SP5)

Security update for the Linux Kernel (Live Patch 85 for SUSE Linux Enterprise 12 SP5)

Security update for the Linux Kernel (Live Patch 82 for SUSE Linux Enterprise 12 SP5)

Security update for the Linux Kernel (Live Patch 73 for SUSE Linux Enterprise 12 SP5)

Security update for the Linux Kernel (Live Patch 75 for SUSE Linux Enterprise 12 SP5)

Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 32 for SUSE Linux Enterprise 15 SP5)

Security update for the Linux Kernel (Live Patch 33 for SUSE Linux Enterprise 15 SP5)

Security update for the Linux Kernel (Live Patch 31 for SUSE Linux Enterprise 15 SP5)

Security update for the Linux Kernel (Live Patch 19 for SUSE Linux Enterprise 15 SP7)

Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP6)