https://cert-portal.siemens.com/productcert/html/ssa-265688.html

https://cert-portal.siemens.com/productcert/html/ssa-355557.html

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST CWE-476

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.14.256 up to (excluding) 4.19
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.218 up to (excluding) 5.4
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.162 up to (excluding) 5.10
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.82 up to (excluding) 5.10.227
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.5 up to (excluding) 5.15.168
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.113
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.55
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.14
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.11 up to (excluding) 6.11.3
     *cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*

https://git.kernel.org/stable/c/1598d70ad9c7d0a4d9d54b82094e9f45908fda6d No Types Assigned

https://git.kernel.org/stable/c/1598d70ad9c7d0a4d9d54b82094e9f45908fda6d Patch

https://git.kernel.org/stable/c/25ab0b87dbd89cecef8a9c60a02bb97832e471d1 No Types Assigned

https://git.kernel.org/stable/c/25ab0b87dbd89cecef8a9c60a02bb97832e471d1 Patch

https://git.kernel.org/stable/c/81fd007dcd47c34471766249853e4d4bce8eea4b No Types Assigned

https://git.kernel.org/stable/c/81fd007dcd47c34471766249853e4d4bce8eea4b Patch

https://git.kernel.org/stable/c/939c88cbdc668dadd8cfa7a35d9066331239041c No Types Assigned

https://git.kernel.org/stable/c/939c88cbdc668dadd8cfa7a35d9066331239041c Patch

https://git.kernel.org/stable/c/ba26060a29d3ca1bfc737aa79f7125128f35147c No Types Assigned

https://git.kernel.org/stable/c/ba26060a29d3ca1bfc737aa79f7125128f35147c Patch

https://git.kernel.org/stable/c/c20029db28399ecc50e556964eaba75c43b1e2f1 No Types Assigned

https://git.kernel.org/stable/c/c20029db28399ecc50e556964eaba75c43b1e2f1 Patch

https://git.kernel.org/stable/c/d6114993e0a89fde84a60a60a8329a571580b174 No Types Assigned

https://git.kernel.org/stable/c/d6114993e0a89fde84a60a60a8329a571580b174 Patch

https://git.kernel.org/stable/c/d70ca7598943572d5e384227bd268acb5109bf72 No Types Assigned

https://git.kernel.org/stable/c/d70ca7598943572d5e384227bd268acb5109bf72 Patch

https://git.kernel.org/stable/c/f959cce8a2a04ce776aa8b78e83ce339e0d7fbac No Types Assigned

https://git.kernel.org/stable/c/f959cce8a2a04ce776aa8b78e83ce339e0d7fbac Patch

kernel.org https://git.kernel.org/stable/c/1598d70ad9c7d0a4d9d54b82094e9f45908fda6d [No types assigned]

kernel.org https://git.kernel.org/stable/c/d70ca7598943572d5e384227bd268acb5109bf72 [No types assigned]

In the Linux kernel, the following vulnerability has been resolved:

net: avoid potential underflow in qdisc_pkt_len_init() with UFO

After commit 7c6d2ecbda83 ("net: be more gentle about silly gso
requests coming from user") virtio_net_hdr_to_skb() had sanity check
to detect malicious attempts from user space to cook a bad GSO packet.

Then commit cf9acc90c80ec ("net: virtio_net_hdr_to_skb: count
transport header in UFO") while fixing one issue, allowed user space
to cook a GSO packet with the following characteristic :

IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28.

When this packet arrives in qdisc_pkt_len_init(), we end up
with hdr_len = 28 (IPv4 header + UDP header), matching skb->len

Then the following sets gso_segs to 0 :

gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
                        shinfo->gso_size);

Then later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/

qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;

This leads to the following crash in fq_codel [1]

qdisc_pkt_len_init() is best effort, we only want an estimation
of the bytes sent on the wire, not crashing the kernel.

This patch is fixing this particular issue, a following one
adds more sanity checks for another potential bug.

[1]
[   70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000
[   70.724561] #PF: supervisor read access in kernel mode
[   70.724561] #PF: error_code(0x0000) - not-present page
[   70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0
[   70.724561] Oops: Oops: 0000 [#1] SMP NOPTI
[   70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991
[   70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel
[ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11

kernel.org https://git.kernel.org/stable/c/25ab0b87dbd89cecef8a9c60a02bb97832e471d1 [No types assigned]

kernel.org https://git.kernel.org/stable/c/81fd007dcd47c34471766249853e4d4bce8eea4b [No types assigned]

kernel.org https://git.kernel.org/stable/c/939c88cbdc668dadd8cfa7a35d9066331239041c [No types assigned]

kernel.org https://git.kernel.org/stable/c/ba26060a29d3ca1bfc737aa79f7125128f35147c [No types assigned]

kernel.org https://git.kernel.org/stable/c/c20029db28399ecc50e556964eaba75c43b1e2f1 [No types assigned]

kernel.org https://git.kernel.org/stable/c/d6114993e0a89fde84a60a60a8329a571580b174 [No types assigned]

kernel.org https://git.kernel.org/stable/c/f959cce8a2a04ce776aa8b78e83ce339e0d7fbac [No types assigned]