| Message ID | 20230421012921.33113-1-cengiz.can@canonical.com |
|---|---|
| Headers | show |
| Series | CVE-2022-3586 | expand |
On 23/04/21 04:29AM, Cengiz Can wrote: > [Impact] > A flaw was found in the Linux kernel’s networking code. A use-after-free was > found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb > field after the same SKB had been enqueued (and freed) into a child qdisc. > This flaw allows a local, unprivileged user to crash the system, causing a > denial of service. > > [Fix] > Clean cherry picks from upstream. > > Please do note that OEM-5.17 already has commit 9efd23297cca ("sch_sfb: Don't > assume the skb is still around after enqueueing to child") thus excluded from > patchset. > > [Test case] > Boot and basic network functionality tested with ntop and wget. > > [Potential regression] > Low. Fix has been in other kernels for quite a while now. > > Toke Høiland-Jørgensen (2): > sch_sfb: Don't assume the skb is still around after enqueueing to > child > sch_sfb: Also store skb len before calling child enqueue > > net/sched/sch_sfb.c | 13 ++++++++----- > 1 file changed, 8 insertions(+), 5 deletions(-) > > -- > 2.37.2 Acked-by: Andrei Gherzan <andrei.gherzan@canonical.com>
On Fri, Apr 21, 2023 at 04:29:19AM +0300, Cengiz Can wrote: > [Impact] > A flaw was found in the Linux kernel’s networking code. A use-after-free was > found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb > field after the same SKB had been enqueued (and freed) into a child qdisc. > This flaw allows a local, unprivileged user to crash the system, causing a > denial of service. > > [Fix] > Clean cherry picks from upstream. > > Please do note that OEM-5.17 already has commit 9efd23297cca ("sch_sfb: Don't > assume the skb is still around after enqueueing to child") thus excluded from > patchset. > > [Test case] > Boot and basic network functionality tested with ntop and wget. > > [Potential regression] > Low. Fix has been in other kernels for quite a while now. > > Toke Høiland-Jørgensen (2): > sch_sfb: Don't assume the skb is still around after enqueueing to > child > sch_sfb: Also store skb len before calling child enqueue > > net/sched/sch_sfb.c | 13 ++++++++----- > 1 file changed, 8 insertions(+), 5 deletions(-) > > -- > 2.37.2 Acked-by: Cory Todd <cory.todd@canonical.com>
Cengiz Can kirjoitti 21.4.2023 klo 4.29: > [Impact] > A flaw was found in the Linux kernel’s networking code. A use-after-free was > found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb > field after the same SKB had been enqueued (and freed) into a child qdisc. > This flaw allows a local, unprivileged user to crash the system, causing a > denial of service. > > [Fix] > Clean cherry picks from upstream. > > Please do note that OEM-5.17 already has commit 9efd23297cca ("sch_sfb: Don't > assume the skb is still around after enqueueing to child") thus excluded from > patchset. > > [Test case] > Boot and basic network functionality tested with ntop and wget. > > [Potential regression] > Low. Fix has been in other kernels for quite a while now. > > Toke Høiland-Jørgensen (2): > sch_sfb: Don't assume the skb is still around after enqueueing to > child > sch_sfb: Also store skb len before calling child enqueue > > net/sched/sch_sfb.c | 13 ++++++++----- > 1 file changed, 8 insertions(+), 5 deletions(-) > > -- > 2.37.2 > > applied to oem-5.17, thanks. 5.14 is EOL
[Impact] A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service. [Fix] Clean cherry picks from upstream. Please do note that OEM-5.17 already has commit 9efd23297cca ("sch_sfb: Don't assume the skb is still around after enqueueing to child") thus excluded from patchset. [Test case] Boot and basic network functionality tested with ntop and wget. [Potential regression] Low. Fix has been in other kernels for quite a while now. Toke Høiland-Jørgensen (2): sch_sfb: Don't assume the skb is still around after enqueueing to child sch_sfb: Also store skb len before calling child enqueue net/sched/sch_sfb.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) -- 2.37.2