oss-security - CVE-2015-5156 : virt-io max-skb-frags heap overflow.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1756750062.4665492.1438836654512.JavaMail.zimbra@redhat.com>
Date: Thu, 6 Aug 2015 00:50:54 -0400 (EDT)
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-5156 : virt-io max-skb-frags heap overflow.

Gday,

When a guests KVM network devices is in a bridge configuration the kernel can 
create a situation in which packets are fragmented in an unexpected fashion. 
The GRO functionality can create a situation in which multiple SKB's are 
chained together in a single packets fraglist (by design).  

The virtio module declares support for NETIF_F_FRAGLIST and assumes that there
are at most MAX_SKB_FRAGS + 2 fragments which isn't always true with a 
fraglist, when GRO is enabled on the incoming driver it can create more fragments
than expected.

A longer than expected fragment list in the socket buffer will make the call
to skb_to_sgvec overflow the sg array, leading to memory corruption, and denial
of service.

An unprivileged attacker could use this flaw to crash the system resulting in DoS.

Red Hat would like to thank Jason Wang for reporting this issue.

Upstream fixes:
---------------
  -> http://marc.info/?l=linux-netdev&m=143868216724068&w=2

Red Hat Bugzilla:
----------------
  -> https://bugzilla.redhat.com/show_bug.cgi?id=1243852

Thanks,

Wade Mealing

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.