If a network driver provides to napi_gro_frags() an skb with a page fragment of exactly 14 bytes, the call to gro_pull_from_frag0() will 'consume' the fragment by calling skb_frag_unref(skb, 0), and the page might be freed and reused. Reading eth->h_proto at the end of napi_frags_skb() might read mangled data, or crash under specific debugging features.
It is possible that an attacker who is able to trigger this situation may be able to crash the system. The upstream description describes this flaw as a use-after-free, it appears that this is only able to be triggered as a denial of service but other effects look unlikely although this has not been fully investigated.
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1781207]
This was fixed for Fedora with the 5.0.21 stable kernel updates.
Looks like http://patchwork.lab.bos.redhat.com/patch/271215/ is internal to RedHat.
Are there any external references (e.g. the fix in the mainline or stable kernels)?
Unfortunately, no external references yet.
Looking at the given description, this matches upstream commit https://git.kernel.org/linus/a4270d6795b0580287453ea55974d948393e66ef in v5.2-rx3 which was backported as well to various stable series 3.16.75, 4.4.181, 4.9.181, 4.14.124, 4.19.48, 5.0.21, 5.1.7.
Thank you, Salvatore! Looks like this is it indeed.
And here is, perhaps, the syzbot's report mentioned in the commit message:
Disabling GSO on the cards using ethtool will prevent this codepath from being taken.
This issue is rated as having Moderate impact because it appears to be limited to only to a crash.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:2854 https://access.redhat.com/errata/RHSA-2020:2854
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):