Critical GSO Packet Vulnerability in Linux Kernel - CVE-2024-49948
Summary
CVE-2024-49948: In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdisc_pkt_len_init() One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. Affects linux versions < 5.10.234-1. Fixed in 5.10.234-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, facilitates communication between software and hardware, and ensures system stability. This vulnerability affects the kernel's networking stack, specifically the handling of Generic Segmentation Offload (GSO) packets, which are used to optimize network performance by allowing large packets to be split into smaller ones for transmission.
Vulnerability Detail
CVE-2024-49948 is a vulnerability in the Linux kernel that arises from insufficient validation of GSO packets. The issue occurs in the function virtio_net_hdr_to_skb(), which does not fully dissect TCP headers, leading to a scenario where a malicious user can craft a GSO packet with a total length of 80 bytes. This packet could consist of a 20-byte IPv4 header, a 60-byte TCP header, and a small gso_size of 8. The function incorrectly identifies this as a valid GSO packet, potentially causing underflows in the packet length calculations, which can lead to memory corruption and system instability.
How To Fix
Minimum fixed version
5.10.234-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable GSO for the affected network interfaces. This can be done by executing the following command: 'ethtool -K <interface> gso off', replacing <interface> with the name of your network interface (e.g., eth0). This will prevent the kernel from processing GSO packets until a patch is applied.
Conclusion
CVE-2024-49948 is a critical vulnerability in the Linux kernel that affects the handling of GSO packets, posing risks of memory corruption and system instability. It is crucial for users to update their systems to the latest kernel version to mitigate these risks. Temporary workarounds, such as disabling GSO, can also be employed until a permanent fix is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2024-49948 is a vulnerability in the Linux kernel that allows for the exploitation of improperly validated GSO packets, potentially leading to memory corruption.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by CVE-2024-49948.
Failure to address this vulnerability could lead to system instability, crashes, or exploitation by malicious users, resulting in unauthorized access or data loss.
Yes, a patch is available. Users should update their Linux kernel to the latest version to mitigate the risk associated with CVE-2024-49948.
Yes, you can disable GSO on your network interfaces using the command 'ethtool -K <interface> gso off' to prevent processing of GSO packets until a patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
