PT-2026-61364 · Linux · Linux
CVE-2026-64047
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix off-by-one in sg chain entry count for wrapped sk msg ring
When an sk msg scatterlist ring wraps (sg.end < sg.start),
tls push record() chains the tail portion of the ring to the head
using sg chain(). An extra entry in the sg array is reserved for
this:
struct sk msg sg {
[...]
/* The extra two elements:
* 1) used for chaining the front and sections when the list becomes
* partitioned (e.g. end < start). The crypto APIs require the
* chaining;
* 2) to chain tailer SG entries after the message.
*/
struct scatterlist data[MAX MSG FRAGS + 2];
The current code uses MAX SKB FRAGS + 1 as the ring size:
sg chain(&msg pl->sg.data[msg pl->sg.start],
MAX SKB FRAGS - msg pl->sg.start + 1,
msg pl->sg.data);
This places the chain pointer at
sg chain(data[start], (MAX SKB FRAGS - msg start + 1) .. =
&data[start] + (MAX SKB FRAGS - msg start + 1) - 1 =
data[start + (MAX SKB FRAGS - start + 1) - 1] =
data[MAX SKB FRAGS]
instead of the true last entry. This is likely due to a "race" of
the commit under Fixes landing close to
commit 031097d9e079 ("bpf: sk msg, zap ingress queue on psock down")
Convert to ARRAY SIZE and drop the data[start] / - start (as suggested
by Sabrina).
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux