Linux Kernel Frag Gap Accounting Vulnerability in Paged Allocation Path

A vulnerability in the Linux kernel's IPv4 handling has been addressed. The issue arose in the 'ip_append_data' function within the paged-allocation branch. Here, the calculations for 'alloclen' and 'pagedlen' were incorrect. While 'datalen' included the 'fraggap' from the previous socket buffer (skb), this gap was not properly accounted for in the new skb's linear area, leading to an oversized 'pagedlen' and an undersized linear area. The non-paged branch correctly accounted for the frag gap, but the paged branch did not. This vulnerability could potentially be exploited by manipulating packet fragmentation, causing data to be incorrectly processed or copied, which could lead to data corruption or other unintended behaviors.

Impact

This vulnerability could cause data corruption by mismanaging how fragmented packets are processed, particularly in the paged allocation path. The incorrect handling of the frag gap could lead to negative offsets when copying data, potentially causing the system to misinterpret or mishandle network traffic.

Reproduction

The vulnerability can be reproduced by sending fragmented IPv4 packets that include a fraggap. When the Linux kernel processes these packets in the paged allocation path, the 'fraggap' is not correctly accounted for, leading to an undersized linear area for the packet data. This can be observed by monitoring the packet processing in the 'ip_append_data' function, where the incorrect calculations for 'alloclen' and 'pagedlen' can be seen.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version can be found on the official Linux kernel website.