oss-sec mailing list archives
CVE-2015-5156 : virt-io max-skb-frags heap overflow.
From: Wade Mealing <wmealing () redhat com>
Date: Thu, 6 Aug 2015 00:50:54 -0400 (EDT)
Gday, When a guests KVM network devices is in a bridge configuration the kernel can create a situation in which packets are fragmented in an unexpected fashion. The GRO functionality can create a situation in which multiple SKB's are chained together in a single packets fraglist (by design). The virtio module declares support for NETIF_F_FRAGLIST and assumes that there are at most MAX_SKB_FRAGS + 2 fragments which isn't always true with a fraglist, when GRO is enabled on the incoming driver it can create more fragments than expected. A longer than expected fragment list in the socket buffer will make the call to skb_to_sgvec overflow the sg array, leading to memory corruption, and denial of service. An unprivileged attacker could use this flaw to crash the system resulting in DoS. Red Hat would like to thank Jason Wang for reporting this issue. Upstream fixes: --------------- -> http://marc.info/?l=linux-netdev&m=143868216724068&w=2 Red Hat Bugzilla: ---------------- -> https://bugzilla.redhat.com/show_bug.cgi?id=1243852 Thanks, Wade Mealing
Current thread:
- CVE-2015-5156 : virt-io max-skb-frags heap overflow. Wade Mealing (Aug 05)