udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x through 5.0.11 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue. Introduced in: http://git.kernel.org/linus/e20cf8d3f1f763ad28a9cb3b41305b8a8a42653e Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4dd2b82d5adfbe0b1587ccad7a8f76d826120f37 References: https://www.spinics.net/lists/netdev/msg568315.html http://www.openwall.com/lists/oss-security/2019/05/02/1 https://www.openwall.com/lists/oss-security/2019/05/05/4 https://seclists.org/oss-sec/2019/q2/86 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.13
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1707359]
Statement: This flaw did not affect the versions of kernel as shipped with Red Hat Enterprise Linux 5, 6, 7 and 8.