Red Hat Bugzilla – Bug 1479307
CVE-2017-1000112 kernel: Exploitable memory corruption due to UFO to non-UFO path switch
Last modified: 2017-09-05 08:12:42 EDT
A memory corruption issue was found in the Linux kernel.
When building a UFO packet with MSG_MORE __ip_append_data() calls
ip_ufo_append_data() to append. However in between two send() calls,
the append path can be switched from UFO to non-UFO one, which leads
to a memory corruption.
In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len
becomes negative on the non-UFO path and the branch to allocate new
skb is taken. This triggers fragmentation and computation of fraggap =
skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy =
datalen - transhdrlen - fraggap to become negative. Subsequently
skb_copy_and_csum_bits() writes out-of-bounds.
Name: Andrey Konovalov
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1480465]
This issue affects the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5,6, 7 and MRG-2.
Future Linux kernel updates for the respective releases may address this issue.
This mainly affects systems that have UFO (UDP fragment offload) enabled.
You can see if this is configured on or off with the ethool command:
# ethtool -k em1 |grep "udp-fragmentation-offload:"
udp-fragmentation-offload: off [fixed]
If enabled, disabling the UDP fragementation offload will mitigate this flaw and is documented in this solution: https://access.redhat.com/solutions/2127401
Fix is at: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa