Wpis z mikrobloga

tcp: take care of truncations done by skfilter()
With syzkaller help, Marco Grassi found a bug in TCP stack,
crashing in tcp
collapse()

Root cause is that skfilter() can truncate the incoming skb,
but TCP stack was not really expecting this to happen.
It probably was expecting a simple DROP or ACCEPT behavior.

We first need to make sure no part of TCP header could be removed.
Then we need to adjust TCP
SKBCB(skb)->endseq

Many thanks to syzkaller team and Marco for giving us a reproducer.

link do git kernel

#linux #unix #security #hackingnews #devops
  • Odpowiedz
  • Otrzymuj powiadomienia
    o nowych komentarzach