Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <9C169F9F-D2C0-40F9-92B2-5FBDEBDD4FDE@oracle.com>
Date: Wed, 24 Jul 2024 17:23:47 +0000
From: John Haxby <john.haxby@...cle.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
CC: Dongli Zhang <dongli.zhang@...cle.com>
Subject: inux kernel: virtio-net host dos 

Hello,

We recently have discovered a Denial-of-Service (DoS) attack issue that 
a KVM guest VM using virtio-net can crash the Linux host by sending a 
short packet (i.e.  size < ETH_HLEN). The packet may traverse through 
vhost-net, macvtap and vlan without any validation/drop. When this 
packet is presented to mlx5 driver on the host side, the host panic 
happens, since mlx5_core assumes the frame size is always >= ETH_HLEN.

Patches have been posted to netdev with the following cover letter.
I'll post the commit IDs when I have them.

jch

~~~

Message-Id: <20240724170452.16837-1-dongli.zhang@...cle.com>
Date: Wed, 24 Jul 2024 10:04:50 -0700
From: Dongli Zhang <dongli.zhang@...cle.com>
To: <netdev@...r.kernel.org>
Subject: [PATCH net 0/2] tap/tun: harden by dropping short frame

This is to harden all of tap/tun to avoid any short frame smaller than the
Ethernet header (ETH_HLEN).

While the xen-netback already rejects short frame smaller than ETH_HLEN ...

 914 static void xenvif_tx_build_gops(struct xenvif_queue *queue,
 915                                      int budget,
 916                                      unsigned *copy_ops,
 917                                      unsigned *map_ops)
 918 {
... ...
1007                 if (unlikely(txreq.size < ETH_HLEN)) {
1008                         netdev_dbg(queue->vif->dev,
1009                                    "Bad packet size: %d\n", txreq.size);
1010                         xenvif_tx_err(queue, &txreq, extra_count, idx);
1011                         break;
1012                 }

... the short frame may not be dropped by vhost-net/tap/tun.

This fixes CVE-2024-41090 and CVE-2024-41091.

Thank you very much!

Dongli Zhang




Download attachment "signature.asc" of type "application/pgp-signature" (269 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.