tipc: skb_linearize the head skb when reassembling msgs
Summary
UVI-2021-1000704: tipc: skb_linearize the head skb when reassembling msgs. Affects Kernel versions >= 45c8b7b175ceb2d542e0fe15247377bf3bce29ec, < b2c8d28c34b3070407cb1741f9ba3f15d0284b8b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Kernel is a critical component of the Linux operating system that provides essential services and functions to enable the system's operation. It manages system resources, facilitates communication between hardware and software components, and ensures the security and stability of the system. The vulnerability in question affects the Transmission Control Protocol (TIPC) module within the Kernel. TIPC is a communication protocol used for inter-process communication in distributed systems. It allows processes running on different nodes to exchange messages reliably and efficiently. The vulnerability arises when reassembling messages in TIPC, specifically when handling skb (socket buffer) data structures. The issue can potentially lead to security vulnerabilities and impact the overall stability and reliability of the system.
Vulnerability Detail
The vulnerability arises from a failure to properly handle skb data structures when reassembling messages in the TIPC module. Specifically, the head skb is not linearized, which can result in memory corruption or other security vulnerabilities. An attacker could potentially exploit this vulnerability to execute arbitrary code, escalate privileges, or cause a denial-of-service condition. The impact and attack plausibility of this vulnerability have not been proven yet. The vulnerability was introduced in version v4.3 of the Linux Kernel and has been fixed in version v4.4.271 by commit b2c8d28c34b3070407cb1741f9ba3f15d0284b8b.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in the commit b2c8d28c34b3070407cb1741f9ba3f15d0284b8b to the affected version of the Kernel. The patch ensures that the head skb is linearized when reassembling messages in TIPC. Here is an example of the patch:
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -123,6 +123,7 @@ static struct sk_buff *tipc_msg_reasm(struct sk_buff_head *list, u32 *msg_size)
struct sk_buff *skb;
struct tipc_msg *hdr;
struct tipc_msg *prev_hdr;
+ struct sk_buff *head_skb;
u32 prev_seq;
u32 seq;
u32 size;
@@ -137,6 +138,9 @@ static struct sk_buff *tipc_msg_reasm(struct sk_buff_head *list, u32 *msg_size)
prev_hdr = hdr;
hdr = tipc_msg_next(hdr);
}
+
+ head_skb = skb_peek(list);
+ skb_linearize(head_skb);
*msg_size = size;
return list;
Conclusion
In conclusion, the vulnerability in the TIPC module of the Linux Kernel can lead to security vulnerabilities and impact the stability and reliability of the system. It is crucial to update the Kernel to the fixed version or apply the provided patch to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific system and its configuration. However, potential consequences include memory corruption, arbitrary code execution, privilege escalation, and denial-of-service conditions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it and provide real-time alerts for open-source vulnerabilities, including this one.
Yes, a workaround is available for this vulnerability. Users can apply the provided patch to the affected version of the Kernel. The patch ensures that the head skb is linearized when reassembling messages in TIPC.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.4.271 or later. This can be done by obtaining the updated Kernel source code from the official repository and compiling it according to the provided instructions.
You can find more information about this vulnerability in the official vulnerability report available at https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1000xxx/UVI-2021-1000704.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
