UDP GSO Fraglist Segmentation Vulnerability in Linux Kernel
Summary
CVE-2024-49978: In the Linux kernel, the following vulnerability has been resolved: gso: fix udp gso fraglist segmentation after pull from frag_list Detect gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segm... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and versatility, supporting a wide range of devices and applications. However, vulnerabilities can arise, impacting system stability and security. This specific vulnerability affects the kernel's handling of UDP GSO (Generic Segmentation Offload) fraglist, which is crucial for efficient network data transmission.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of GSO fraglist skbs (socket buffers) that can lead to a NULL pointer dereference. This issue occurs when optional datapath hooks, such as NAT and BPF, modify the skbs, potentially corrupting their geometry. If all data is pulled into skb linear, it can cause a crash in the __udpv4_gso_segment_list_csum function, leading to system instability. The vulnerability affects the segmentation process of UDP packets, which can result in data loss or denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using optional datapath hooks that modify skbs until the kernel is updated. This may help prevent the corruption of skb geometry.
Conclusion
The CVE-2024-49978 vulnerability in the Linux kernel poses significant risks to system stability and security due to improper handling of UDP GSO fraglist skbs. Users are strongly advised to update their kernel to the patched version to mitigate these risks. Temporary workarounds are available, but they do not replace the need for a proper update.
See every vulnerability recorded for linux →
FAQ
CVE-2024-49978 is a vulnerability in the Linux kernel that affects the segmentation of UDP GSO fraglist skbs, potentially leading to system crashes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without signing up.
The vulnerability can lead to a NULL pointer dereference, causing system instability, data loss, or denial of service.
Yes, a patch has been released for the Linux kernel. Users should update their kernel to the latest version to mitigate the vulnerability.
If an immediate update is not possible, consider disabling optional datapath hooks that modify skbs as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
